Cyber Security

New Twitter phishing campaign targets verified accounts

A new phishing campaign has been targeting verified Twitter accounts, as seen by BleepingComputer.

Verified accounts on Twitter refer to those possessing a blue badge with a checkmark. These accounts typically represent notable influencers, prominent celebrities, politicians, journalists, activists, as well as government and private organizations.

The phishing campaign follows Twitter’s recent removal of the checkmarks from a number of verified accounts, citing that these were ineligible for the legendary status, and were verified in error.

‘Don’t lose you [sic] verified status!’

Over the weekend, BleepingComputer came across a phishing campaign aimed at verified Twitter users.

The phishing email shown below urges the Twitter user to “update” their details so as to not risk losing their verified status. Note, the email successfully made it past Gmail’s spam filters:

Twitter verification phishing email urging user to “update” their profile ​​​​​​ (BleepingComputer)

These emails are being sent at a time when Twitter is inexplicably removing the “blue tick” verified status from a number of notable accounts, such as that of the English television presenter, producer, and Heart Radio’s national breakfast show host, Jamie Theakston:

The Twitter account of Bloxy News with its 556,000+ followers is yet another example that was presented with a generic message as the reason behind revoked verification status.

Unsurprisingly, Twitter’s ongoing takedown of blue badges has ruffled many feathers on Twitterverse as accounts endorsed with the blue badge are often perceived as distinguished, notable, and expected to lead by example—at least that’s what Twitter tells you after verifying you:”As you know, a verified badge tells people that your account is notable and authentic. And being a part of this ‘blue badge’ Twitter community comes with responsibility. We hope you use it well. (Serious voice) All accounts, including verified accounts, need to follow the Twitter Rules.”

“To keep your verified status, please keep in mind that your Twitter account must always be complete. This means having either a verified email address or phone number, a profile image, and a display name. Any verified account in severe or repeated violation of our rules may lose their blue badge.”

Some took notice that the timing of Twitter’s en-masse blue badge takedown coincides with changes in the executive leadership—after former Twitter CEO Jack Dorsey resigned and handed on the torch to CTO Parag Agrawal.

Phishing campaign collects two-factor codes

The phishing email discovered by BleepingComputer is sent to verified users, many of whom may choose to list an email address in their bio for business reasons.

At least in my case, the phishing message arrived at the email address listed in my public Twitter bio rather than the one associated with my Twitter account:

Twitter profile with an email address in Bio

The phishing message first entices the user to tap the “Update here” button.

The button links to https://www.cleancredit[.]in/wp-content/uploads/2021/12/index.html which further redirects the user to a page living at: https://dublock[.]com/dublock/twitter/

It appears both of these websites have been compromised and being abused by the attackers to host phishing pages:

Phishing form prompts user for Twitter credentials (BleepingComputer)

After entering Twitter credentials, that the form poorly validates, the user is prompted to also provide the two-factor authentication code sent to them:

Twitter phishing form collecting two-factor codes (BleepingComputer)

After gathering the user’s Twitter username, password, and two-factor authentication code, the phishing page redirects the user to the Twitter homepage.

Twitter users, verified or not, should be wary of such phishing emails and refrain from opening any links or attachments within. 

Source: https://www.bleepingcomputer.com/news/security/new-twitter-phishing-campaign-targets-verified-accounts/

Advertisement. Scroll to continue reading.
Click to comment

You May Also Like

Cyber Security

The Cyber Safety Review Board will assess how a hacking group reportedly linked to China leveraged a vulnerability in Microsoft Exchange Online to access...

Cyber Security

Security researchers observed a new campaign they attribute to the Charming Kitten APT group where hackers used new NokNok malware that targets macOS systems. The...

Cyber Security

A new phishing campaign is exploiting the increasing interest of security community members towards Flipper Zero to steal their personal information and cryptocurrency. Flipper...

Cyber Security

New phishing attacks use a Windows zero-day vulnerability to drop the Qbot malware without displaying Mark of the Web security warnings. When files are...

Copyright © 2023 Newsworthy News | Global | Political | Local | All News | Website By: Top Search SEO

Exit mobile version