Phishing scam hits Twitter. Don't get sucked in!
Phishers are up to the same old tricks, with a new target: your Twitter password. Several Twitter users received a direct message today that included a Blogspot link purporting to be about "a funny blog about you!" They clicked on it and found themselves redirected to a spoofed Twitter login page that grabs passwords and may use your account to propagate the phishing messages to more users.
To be safe, don't click on suspicious links, even though they're coming from people you follow on Twitter, and don't compulsively enter your login info without checking to make sure you're actually on a Twitter.com domain. This scam is particularly tricky because of the nature of direct messages, which have to come from people you've allowed to contact you. The Twitter Eng and Ops teams are aware of the problem, according to a tweet from Twitter's Biz Stone, and a warning message has been added on the Twitter homepage.
To be safe, don't click on suspicious links, even though they're coming from people you follow on Twitter, and don't compulsively enter your login info without checking to make sure you're actually on a Twitter.com domain. This scam is particularly tricky because of the nature of direct messages, which have to come from people you've allowed to contact you. The Twitter Eng and Ops teams are aware of the problem, according to a tweet from Twitter's Biz Stone, and a warning message has been added on the Twitter homepage.













Comments
11
Subscribe to commentsEl TacoJan 3rd 2009 10:00PM
Why do they want your twitter password?
TomJan 3rd 2009 10:07PM
So they can send the link out to everyone who follows you using your account.
El TacoJan 3rd 2009 10:09PM
And then what? Get all those peoples' accounts? Oh no!
ButtersJan 3rd 2009 10:42PM
They will do the same thing they do on Myspace. They get the account login details of thousands users then spam their contacts with advertising for 'cheap replica Rolex watches' or 'free Chanel purses'. You may think it isn't a big deal but no one likes having their login details stolen especially when it then gets used to send spam to their friends.
El TacoJan 3rd 2009 10:44PM
k i get it now thx
AniruddhJan 4th 2009 2:21AM
I think do use https:\\www.twitter.com instead of http://...
and i think all twitter applications and plug ins also do a change and force to use https: connection...let me find out and I'll drop a another comment...
Hany HannaJan 4th 2009 5:52AM
Only Twits Twitter
ToddJan 4th 2009 10:21AM
Part of the larger issue of Twitter not supporting Oauth. Discussion here:
http://factoryjoe.com/blog/2009/01/02/twitter-and-the-password-anti-pattern/
EthanJan 4th 2009 7:36PM
Ha, "a blog about you." They could have just gone "click here to be loved, you're amazing!"
Daniel MassicotteJan 5th 2009 9:43AM
This might be just what Twitter needs to become even more mainstream though.
Ecommerce Job... Where are you?Mar 3rd 2009 4:36PM
Why would anyone have a blog about me? Funny or not funny.