Convincing Microsoft phishing uses fake Office 365 spam alerts
Microsoft reverses Windows 11’s annoying default browser setting changes
US State Dept employees’ phones hacked using NSO spyware
Fake support agents call victims to install Android banking malware
Eurostar tests facial recognition system on London train station
France warns of Nobelium cyberspies attacking French orgs
Hundreds of SPAR stores shut down, switch to cash after cyberattack
WhatsApp adds default disappearing messages for new chats
Qualys BrowserCheck
Junkware Removal Tool
How to remove the PBlock+ adware browser extension
Remove the Search Redirect
Remove the Search Redirect
Remove the Search Redirect
Remove Security Tool and SecurityTool (Uninstall Guide)
How to remove Antivirus 2009 (Uninstall Instructions)
How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller
Locky Ransomware Information, Help Guide, and FAQ
CryptoLocker Ransomware Information Guide and FAQ
CryptorBit and HowDecrypt Information Guide and FAQ
CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
How to make the Start menu full screen in Windows 10
How to install the Microsoft Visual C++ 2015 Runtime
How to open an elevated PowerShell Admin prompt in Windows 10
How to Translate a Web Page in Google Chrome
How to start Windows in Safe Mode
How to remove a Trojan, Virus, Worm, or other Malware
How to show hidden files in Windows 7
How to see hidden files in Windows
IT Certification Courses
Gear + Gadgets
A new phishing campaign has been targeting verified Twitter accounts, as seen by BleepingComputer.
Verified accounts on Twitter refer to those possessing a blue badge with a checkmark. These accounts typically represent notable influencers, prominent celebrities, politicians, journalists, activists, as well as government and private organizations.
The phishing campaign follows Twitter’s recent removal of the checkmarks from a number of verified accounts, citing that these were ineligible for the legendary status, and were verified in error.
Over the weekend, BleepingComputer came across a phishing campaign aimed at verified Twitter users.
The phishing email shown below urges the Twitter user to “update” their details so as to not risk losing their verified status. Note, the email successfully made it past Gmail’s spam filters:
These emails are being sent at a time when Twitter is inexplicably removing the “blue tick” verified status from a number of notable accounts, such as that of the English television presenter, producer, and Heart Radio’s national breakfast show host, Jamie Theakston:
So @Twitter has removed my blue tick verification because they can’t be sure I’m me. Fair enough, some days I’m not entirely sure myself…
The Twitter account of Bloxy News with its 556,000+ followers is yet another example that was presented with a generic message as the reason behind revoked verification status.
Unsurprisingly, Twitter’s ongoing takedown of blue badges has ruffled many feathers on Twitterverse as accounts endorsed with the blue badge are often perceived as distinguished, notable, and expected to lead by example—at least that’s what Twitter tells you after verifying you:
A CEO left Twitter and now all of sudden ppl getting they verification badges snatched up??? Like WTF!
Some took notice that the timing of Twitter’s en-masse blue badge takedown coincides with changes in the executive leadership—after former Twitter CEO Jack Dorsey resigned and handed on the torch to CTO Parag Agrawal.
The phishing email discovered by BleepingComputer is sent to verified users, many of whom may choose to list an email address in their bio for business reasons.
At least in my case, the phishing message arrived at the email address listed in my public Twitter bio rather than the one associated with my Twitter account:
The phishing message first entices the user to tap the “Update here” button.
The button links to https://www.cleancredit[.]in/wp-content/uploads/2021/12/index.html which further redirects the user to a page living at: https://dublock[.]com/dublock/twitter/
It appears both of these websites have been compromised and being abused by the attackers to host phishing pages:
After entering Twitter credentials, that the form poorly validates, the user is prompted to also provide the two-factor authentication code sent to them:
After gathering the user’s Twitter username, password, and two-factor authentication code, the phishing page redirects the user to the Twitter homepage.
Twitter users, verified or not, should be wary of such phishing emails and refrain from opening any links or attachments within. 
Malicious Excel XLL add-ins push RedLine password-stealing malware
Convincing Microsoft phishing uses fake Office 365 spam alerts
Phishing actors start exploiting the Omicron COVID-19 variant
Twitter removes 3,400 accounts used in govt propaganda campaigns
Emotet now spreads via fake Adobe Windows App Installer packages
Online $tatu$ $ymbol$? I have one comment to make:
Not a member yet? Register Now
Microsoft reverses Windows 11’s annoying default browser setting changes
Convincing Microsoft phishing uses fake Office 365 spam alerts
To receive periodic updates and news from BleepingComputer, please use the form below.
Terms of Use Privacy PolicyEthics Statement
Copyright @ 2003 – 2021 Bleeping Computer® LLC – All Rights Reserved
Not a member yet? Register Now
Read our posting guidelinese to learn what content is prohibited.


You May Also Like

Tor’s main site blocked in Russia as censorship widens

Emotet now drops Cobalt Strike, fast forwards ransomware attacksSonicWall ‘strongly urges’ customers…

Fake support agents call victims to install Android banking malware

FBI: Cuba ransomware breached 49 US critical infrastructure orgsResearchers discover 14 new…

Marine services provider Swire Pacific Offshore hit by ransomware

Hackers exploit Microsoft MSHTML bug to steal Google, Instagram credsApple sues spyware-maker…

Microsoft rolls out end-to-end encryption for Teams calls

Microsoft December 2021 Patch Tuesday fixes 6 zero-days, 67 flawsBugs in billions…