Malwarebytes has uncovered a phishing campaign that uses Twitter's Promoted Tweets to pull people in, promising them that they can become verified while actually stealing credit card information.
The tweet reads simply "Get Verified. Go to goo.gl/zuGHjg." When the link is clicked, it takes the user to an official-looking landing page with the text: "Welcome to Twitter Verification. Hundreds of millions of people use Twitter to discover what's happening in the world. Twitter can help you connect with them and achieve meaningful results.
"Being verified is more than a cool badge on your profile, it signifies authenticity and ensures the community that you are an official account."
To get verified, the web page claims your username, email address, company name, phone number and password is needed, plus other information related to a Twitter Ads account and how many followers the victim has.
It then asks for a card number, expiry date, security code, name, billing address, and contact email, which it claims, it uses to prove the person is who they say they are.
"To prevent identity confusion, Twitter is now offering the "verification form". We're working to establish authenticity with people who deal with impersonation or identity confusion on a regular basis. Accounts with a [Tick] are the official accounts."
The page is listed as being secure until the payment details are requested, at which point the browser flags the page as containing insecure content.
Malwarebytes discovered that although this flag may have deterred some wary people, the Tweet was clicked by 812 people and almost all of those clicked on the link to the phishing website. The majority of users accessed the phishing site using an iPhone and were from the US.
Twitter hasn't yet commented on the vulnerability, neither has it revealed whether they are vetted. The site's FAQ simply says they're the same as other tweets and can be retweeted, replied to and liked, but are just used to spark engagement from existing followers.
