Tweet

A new Twitter worm is making the rounds. If you receive a direct message from a “friend” that contains the following message:

“This you????”

It is likely malicious. Clicking the link, http://twitter.login.{BLOCKED}home.org/login/, will redirect you to a subpage of the said domain. You will then be prompted to log in to your Twitter account.

Note how closely the fake login page duplicates Twitter’s actual login page:

Once you log in, your credentials will be stolen and all of your followers will receive a direct message from you with a link to the same site, allowing the worm to further propagate. Doubtlessly, at some point in the future, the cybercriminals behind this attack will use the same stolen credentials to send out other malicious content from a huge number of compromised Twitter accounts.

So remember, think before you click! For more great tips and tricks with regard to social networking, you may read this.

Trend Micro™ Smart Protection Network™ protects product users from this kind of attack by blocking user access to the malicious domain and other related sites.