Fake Twitter profile blocking is used as bait to steal data

The risk of losing your Twitter account was the bait used in a fraudulent email campaign aimed at stealing users’ credentials and data from fake websites. The page, which had already been taken down, was sent through a legitimate email marketing system as a way to evade detection by security systems and give the fraud an appearance of legitimacy.

  • As a journalist ended a phishing campaign in two days
  • “False romance” scammer stole $1, 8 million seniors in the US
  • Total critical flaws discovered so far in almost doubled

The attempt draws attention for its low sophistication, but at the same time, for how it takes advantage of of common inattentions to go unnoticed. Starting, of course, with the message itself, which features the design and actual text of a Twitter statement about account blocking, even with official help topics and social network security tips — on the button where the Potential victim is prompted to click, however, is the scam, with a fraudulent website that asked for credentials to access the social network.

The email itself was created from from the Ascend platform, a legitimate email marketing service owned by website creation company Wix. The fraudulent website is also hidden by a link from the same company, which helps to hide the fraud intent of automated systems to combat phishing and spam; the same goes for the address responsible for sending, used in tests of triggering advertisements for different email accounts.

Want to catch up on the best tech news of the day? Go and subscribe to our new channel on youtube, Canaltech News.

Every day a summary of the main news in the tech world for you!

Use of legitimate services to create fraudulent email helps scammers hide fraud attempts from automatic protection systems (Image: Screenshot/Felipe Demartini/Canaltech)

The fraudulent message, that the Twitter account would have been blocked after detection of behavior similar to a bot, even sounds ironic within a scam that seems, by itself, to bring evidence of an automated system. The fake alert reached the


report via a publicly available email address on a social media profile; contrary to what it should have, however, the warning came in English, even when sent to a Brazilian user.

This is even the first sign that something is wrong. The attempt to pass itself off as a legitimate company and also to use recognized services to apply scams is a common practice among cybercriminals, who bet on users’ inattention. In this case, the fear of having the account effectively blocked could lead someone to click without even reading the message, were it not, in this case, the fact that the warning was sent to an email that does not even have a Twitter profile attached. .

To avoid being a victim, the ideal is to pay attention before clicking on links that arrive not only by email, but also by instant messengers. Before accessing websites and, especially, delivering personal information through these means, it is important to make sure that the communication is legitimate and the page accessed, too. In case of any doubt, don’t go ahead and look for support sites or telephones on your own — if the request is real, the representatives will surely know about it.

At the moment that this report is written, as said, the fraudulent website that requested the users’ data had already been taken down. Canaltech

also reported the fake message to Wix through the platform’s reporting system.

Did you like this article?

Subscribe your email on Canaltech to receive daily updates with the latest news from the world of technology.


Related Articles

Back to top button