Twitter Hit by Another Direct Message Phishing Scam
It seems like every day that a new phishing scam hits Twitter, and Wednesday was no different. According to CNET News, Twitter warned its users to be on the lookout for a phishing scam that attacks via direct messages. "[If] you've received a strange (direct message), and it takes you to a Twitter log-in page, don't do it!," Twitter warned in a post.
Of course, this isn't the first scam that disguises itself in a direct message. But this message attempts to fool you by posing as a dear friend. According to Sophos, the message reads: "hi. this you on here?" and is followed by a link to the phishing site. The link, if clicked, redirects you to a fake Twitter log-in page, where the phishers intend to steal your user name and password. If you enter both, you'll see a faux over-capacity page that's supposed to make the scam seem more real. When Sophos logged in to the false page, it was directed to the over-capacity page, and then to a blog by someone called NetMeg99. It's unclear as to whether or not that blog is part of the scam, too.
If you've already fallen victim to this scam, change your Twitter password right away. Just to be safe, it might be a good idea to change your password on other sites, too, since that information could be compromised. Even though Twitter is aware of this problem, it wouldn't hurt to use the site's security feature to let them know you've been hacked.
Our last piece of advice: please, please, please don't click unfamiliar links. It's like eating that half of a sandwich you left out overnight; it might look appealing, but you'll likely pay for it later. [From: CNET News and Sophos]
Reader Comments (Page 1 of 1)
Ethan said 11:48AM on 10-29-2009
It won't be long until there are fake warnings of phising scams with links to type in your details to ensure "enhanced security"
Reply
gregorycreaser said 10:22AM on 11-03-2009
"Hi is this you" You Who? ... how about Hi is this Gregory Creaser from NY, now I might take a quick look at that. Are people that desperate to connect to any "stranger" that approaches them and give away their identity. This is absolutely the reason phishers continue to succeed is that end users compromise their own data, and clicking on links in emails is a common mistake. But here at VeriSign we feel that a multiple layered approach to security is best; just to give an example, phishers often embed false links via other routes as well (Twitter, etc) where following urls is not often seen as an issue. If users, however, can immediately see that a Web site is either a potential phishing site or one that has gone through extensive authentication checks (as EV SSL provides), this will no doubt benefit them.
Reply