The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Twitter Phishing Campaign Spreading Via Direct Messages

David Jacoby
Kaspersky Lab Expert
Posted October 16, 14:55  GMT
Tags: Twitter

I got the impression that lately the amount of phishing attacks via social media was not as great as we have seen in the past. But just as I logged in to Twitter today I noticed that I had received two direct messages, and they both had a very similar message.

Two days ago I received the first message, and when I tried to verify if it was a link spreading malware, or a phishing site, the URL was already inactive. Now when I received another one I wanted to look at it quickly, and at the time of writing the phishing site is still active.

The two messages which I received had more or less the same structure, the only difference is the choice of URL shortener, and a word which has been replaced. The two different URL shorteners were bit.ly and y.ahoo.it

"hey, someone is spreading nasty rumours about you URL"

"hey, someone is spreading terrible rumours about you URL"

What happens if you click the URL which is in the message? You will be redirected to the website http://twi[CUT]er.com/ where the attacker has created a rogue Twitter login-page, and if you enter your credentials they will end up in the wrong hands. The stolen credentials will most likely be used to find more victims, but also to maybe find victims on other social media.

After the victims has entered their credentials they will be redirected to a website giving them a fake "404" error code page. Just after 2 seconds the victim will then be redirected to the real Twitter login page.

In the first message I got, the shortened URL redirected to a domain very similar to the one being exploited in the new campaign I'm writing about now. The domain in the previous message was http://tviwtter.com/. This is an indication that its the same people behind the campaigns.

Fellow researchers at Kaspersky Lab have also indications that a wave of phishing attacks are being exploited at Facebook, if the two campaigns are related is at the time impossible to say. Some screenshot of the Facebook campaign can be found below:

At the moment we are working on collecting more URL's in this campaign, if you are aware of any URLs, do not hesitate to contact us. You can contact me on Twitter by tagging @JacobyDavid

Also remember to be very careful when you enter your personal credentials on any site.


Oldest first
Threaded view


2012 Oct 24, 09:08

another variant

One of our reader come across another variant of this phishing attack. In fact, the phishing page is loaded inside fb app.

Here you can find my report:

Also, i've collected some domains registered by the attacker:

There are 36 domains so far but i can't collect all of them. But you can do.



2013 Jan 04, 13:01

Twitter phishing

Today it happened to me and explained the issue on my blog, adding your post as a more detailed explanation of the problem. Hope this get fixed soon.

You can find the post here:


If you would like to comment on this article you must first

Bookmark and Share