Criminals using Twitter Promoted Tweets to phish

Tweet says it can help get your account verified, but actually steals credit card information

Malwarebytes has uncovered a phishing campaign that uses Twitter's Promoted Tweets to pull people in, promising them that they can become verified while actually stealing credit card information.

The tweet reads simply "Get Verified. Go to goo.gl/zuGHjg." When the link is clicked, it takes the user to an official-looking landing page with the text: "Welcome to Twitter Verification. Hundreds of millions of people use Twitter to discover what's happening in the world. Twitter can help you connect with them and achieve meaningful results.

"Being verified is more than a cool badge on your profile, it signifies authenticity and ensures the community that you are an official account."

To get verified, the web page claims your username, email address, company name, phone number and password is needed, plus other information related to a Twitter Ads account and how many followers the victim has.

It then asks for a card number, expiry date, security code, name, billing address, and contact email, which it claims, it uses to prove the person is who they say they are.

"To prevent identity confusion, Twitter is now offering the "verification form". We're working to establish authenticity with people who deal with impersonation or identity confusion on a regular basis. Accounts with a [Tick] are the official accounts."

The page is listed as being secure until the payment details are requested, at which point the browser flags the page as containing insecure content.

Malwarebytes discovered that although this flag may have deterred some wary people, the Tweet was clicked by 812 people and almost all of those clicked on the link to the phishing website. The majority of users accessed the phishing site using an iPhone and were from the US.

Twitter hasn't yet commented on the vulnerability, neither has it revealed whether they are vetted. The site's FAQ simply says they're the same as other tweets and can be retweeted, replied to and liked, but are just used to spark engagement from existing followers.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
IT Pro Panel: Why IT leaders need soft skills
professional development

IT Pro Panel: Why IT leaders need soft skills

26 Jul 2021