Twitter Phishing Campaign Spreading Via Direct Messages

I got the impression that lately the amount of phishing attacks via social media was not as great as we have seen in the past. But just as I logged in to Twitter today I noticed that I had received two direct messages, and they both had a very similar message.

Two days ago I received the first message, and when I tried to verify if it was a link spreading malware, or a phishing site, the URL was already inactive. Now when I received another one I wanted to look at it quickly, and at the time of writing the phishing site is still active.

The two messages which I received had more or less the same structure, the only difference is the choice of URL shortener, and a word which has been replaced. The two different URL shorteners were bit.ly and y.ahoo.it

“hey, someone is spreading nasty rumours about you URL”

“hey, someone is spreading terrible rumours about you URL”

What happens if you click the URL which is in the message? You will be redirected to the website http://twi[CUT]er.com/ where the attacker has created a rogue Twitter login-page, and if you enter your credentials they will end up in the wrong hands. The stolen credentials will most likely be used to find more victims, but also to maybe find victims on other social media.

After the victims has entered their credentials they will be redirected to a website giving them a fake “404” error code page. Just after 2 seconds the victim will then be redirected to the real Twitter login page.

In the first message I got, the shortened URL redirected to a domain very similar to the one being exploited in the new campaign I’m writing about now. The domain in the previous message was http://tviwtter.com/. This is an indication that its the same people behind the campaigns.

Fellow researchers at Kaspersky Lab have also seen indications that a wave of phishing attacks are being aimed at Facebook. Whether or not the two campaigns are related is at this time impossible to say. Some screenshots of the Facebook campaign can be found below:

Fellow researchers at Kaspersky Lab have also indications that a wave of phishing attacks are being exploited at Facebook, if the two campaigns are related is at the time impossible to say. Some screenshot of the Facebook campaign can be found below:

At the moment we are working on collecting more URL’s in this campaign, if you are aware of any URLs, do not hesitate to contact us. You can contact me on Twitter by tagging @JacobyDavid

Also remember to be very careful when you enter your personal credentials on any site.