Another round of phishing hits Twitter

Share this article:

After last week's phishing attacks on social networking sites, yet another round has struck Twitter.

The latest scam involved messages coming from a site called “TwitterCut,” which were posted to users' Twitter streams and purported to guarantee an increase in the number of their followers. But once the link was clicked, the victims were directed to a site that requested them to login with their Twitter credentials. If they did, the site siphoned their list of existing followers and sent similar messages to all of them, along with links to a paid dating service.

Twitter, in acknowledging the problem, posted a note on its status page Tuesday night that said: “We are currently pushing a password reset on accounts we believe may have been caught in a phishing scam.”

On the TwitterCut website, the site operators denied that they had engaged in any phishing, and announced that they were shutting the site down.

“According to several social network blog sites, TwitterCut has been the bud of several rumors,” a message on the site said. “Our website and its programmers can assure you that these rumors are not true and that TwitterCut is simply a Twitter train that was a work in progress!”

The meta content of the site, however, still contains a claim that says: "Need more followers on Twitter? We can promise you thousands or more followers. Come visit us now!"

US-CERT lists a number of ways to avoid being trapped in phishing scams, including not sending information over the internet before checking a website's security and paying attention to the URL of a website (malicious websites may look identical to legitimate sites, but with a variant URL). Another tip is to install and maintain anti-virus software, firewalls and email filters to reduce phishing traffic.

Last week's round of social networking scams involved FackBook messages to users that appeared to come from their friends, but linked to bogus websites, and scammers who created a fake Twitter login page to harvest user credentials.

Share this article:
close

Next Article in News

Sign up to our newsletters

More in News

Report: UK police push for required mobile phone PWs

The Metropolitan Police have reportedly lobbied for two years to enact the standard.

JPMorgan Chase customers targeted in massive phishing campaign

JPMorgan Chase customers targeted in massive phishing campaign

Roughly 500,000 emails have been sent out so far as part of a massive multifaceted phishing campaign targeting customers of JPMorgan Chase.

Study: Organizations lack training, budget to thwart insider threats

Study: Organizations lack training, budget to thwart insider ...

Of the 355 IT and security professionals surveyed, a majority indicated that they were ill-equipped to thwart a possible insider threat.