Tweet points to a Tumblr page that allegedly reveals a secret

Sep 11, 2014 09:56 GMT  ·  By

A phishing campaign run on Twitter tries to dupe users into landing onto a phishing page that’s after the credentials for the microblogging service.

It appears that bots or compromised Twitter accounts are being leveraged to deliver spam text to Twitter users, with a Tumblr link that directs to a phishing location.

According to Christopher Boyd from Malwarebytes, the campaign was highly active at times, with more than 200 messages being sent in ten minutes; the attack was recorded to be carried out for at least six hours.

The fraudulent tweets captured by the security firm purport to reveal a “strange rumor” about the potential victim, in a Tumblr post.

As soon as the URL is accessed, the user is informed that the Twitter session has been interrupted and that signing into the account again should solve the problem.

Simply taking a look at the web address the message originates from reveals the fact that behind the apparent friendly request is actually a scam designed to collect Twitter credentials; lack of an encrypted connection is a dead giveaway that something is not right.

Avoiding such scams is quite easy for a trained user, who can smell the phishing attempt a mile away, but the average Joe may easily walk into the trap.

As such, it is recommended to enable two-factor authentication for the service, a security measure that asks for a second verification code to make sure that the true owner of the account logs in. This code can be delivered as a text message to the phone, thus eliminating the risk of someone else being able to use the username and password.