Twitter Phishing: DMs of Doom

Twitter's DM (Direct Message) capability has led to the all-too-predictable malware attack. In this case, a fake blog link leads the victim to divulge their login credentials, and the zombification of the victim's Twitter account is complete.

The cycle then repeats, with the pwned accounts sending out yet more DMs to yet more random people. To anyone familiar with spam and phishing, these messages are instantly suspicious (who's Stacy A. McCullough?), but this is clearly affecting a lot of people, based on my junk-mail folder.

The fake Twitter landing page looks pretty much identical to the real deal, but the URL is the dead giveaway.

It bears repeating: do not open DM links from users you don't know.