Twitter’s ‘Interesting Times’
Any time you want to create change, you go through some instability. Twitter is no exception. Here is part of that story.
Cyber crooks have already capitalized on Twitter’s ongoing verification chaos by sending phishing emails designed to steal passwords. The campaign lures Twitter users into posting their username and password on to an attacker’s web site disguised as a Twitter help form. It didn’t take long.
In this particular attack, the email is sent from a Gmail account (FIRST CLUE) which links users to a Google Site (SECOND CLUE). That page contains a frame to another site, hosted on the Russian web host Beget (VERY SUBTLE THIRD CLUE), which asks for the user’s Twitter handle, password and phone number. If the user does not have MFA turned on, they are now ‘owned’.
While Twitter declined to comment, Google took down the site, saying that hosting malware is not an acceptable use of their system.
Next bit of chaos – Twitter froze some employee access to internal tools for content moderation and other policy enforcement. While this might make sense under the circumstances, it reduces Twitter’s ability to maintain site safety and integrity.
Twitter says that even though employees don’t have access to content moderation tools, content moderation is happening anyway. Somehow.
Musk has also suggested that users can retain or gain that coveted blue checkmark by paying $20 a month. This could easily be a trial balloon. Or not. If that is all it takes, then a stolen credit card combined with a hacker and not much good happens.
That is yet another scam campaign that is already happening – what to retain/gain a blue checkmark, click here.
Doing this a week before a national election may be a problem as well.
In any case, this will likely get more “interesting” before it gets more stable. That means users need to stay on their toes until this all settles down.
Don’t be surprised if these phishing campaigns escape the boundaries of the Twitter-verse. I could easily concoct a story that would fool Facebook users. Or other platforms.
Remain alert!
Credit: Metacurity
by 