Criminals using Twitter Promoted Tweets to phish
Tweet says it can help get your account verified, but actually steals credit card information
Malwarebytes has uncovered a phishing campaign that uses Twitter's Promoted Tweets to pull people in, promising them that they can become verified while actually stealing credit card information.
The tweet reads simply "Get Verified. Go to goo.gl/zuGHjg." When the link is clicked, it takes the user to an official-looking landing page with the text: "Welcome to Twitter Verification. Hundreds of millions of people use Twitter to discover what's happening in the world. Twitter can help you connect with them and achieve meaningful results.
"Being verified is more than a cool badge on your profile, it signifies authenticity and ensures the community that you are an official account."
To get verified, the web page claims your username, email address, company name, phone number and password is needed, plus other information related to a Twitter Ads account and how many followers the victim has.
It then asks for a card number, expiry date, security code, name, billing address, and contact email, which it claims, it uses to prove the person is who they say they are.
"To prevent identity confusion, Twitter is now offering the "verification form". We're working to establish authenticity with people who deal with impersonation or identity confusion on a regular basis. Accounts with a [Tick] are the official accounts."
The page is listed as being secure until the payment details are requested, at which point the browser flags the page as containing insecure content.
Malwarebytes discovered that although this flag may have deterred some wary people, the Tweet was clicked by 812 people and almost all of those clicked on the link to the phishing website. The majority of users accessed the phishing site using an iPhone and were from the US.
Twitter hasn't yet commented on the vulnerability, neither has it revealed whether they are vetted. The site's FAQ simply says they're the same as other tweets and can be retweeted, replied to and liked, but are just used to spark engagement from existing followers.
Top 5 challenges of migrating applications to the cloud
Explore how VMware Cloud on AWS helps to address common cloud migration challengesDownload now
3 reasons why now is the time to rethink your network
Changing requirements call for new solutionsDownload now
All-flash buyer’s guide
Tips for evaluating Solid-State ArraysDownload now
Enabling enterprise machine and deep learning with intelligent storage
The power of AI can only be realised through efficient and performant delivery of dataDownload now