14 DAY TRIAL // Cybercriminals are relying on Twitter to launch a campaign that’s designed not only to phish out user credentials, but also to spread a piece of malware that’s capable of stealing other sensitive information from the victim’s computer.
It all starts with a message on Twitter which reads: “facebook.com/URL check out Obama punch a guy in the face for calling him a nigger.”
Researchers from Panda Security, the ones who have first discovered this scheme, reveal that the attackers are relying on the outrageous message to trick users into clicking on the link.
Internauts who fall for it and click on the link are taken to a fake Facebook page where they’re prompted to enter their Twitter credentials.
The crooks will use the hijacked Twitter account to spread the Obama message. By using this technique, they can ensure that more people will click on the malicious link because the message appears to be coming from individuals they trust.
However, after they hand over their username and password, it’s not over. Victims are taken to another bogus Facebook website, which apparently attempts to display a video.
The clip cannot be played because a so-called YouTube Player is needed. This YouTube Player actually hides the Koobface LP worm whose main goal is to steal all the personal information it can find on the victim’s device.
“This attack exploits the two most popular social networking sites, Facebook and Twitter, to trick users into believing they are viewing a trusted site,” Panda Labs’ Luis Corrons writes.
“It also relies on its victims’ curiosity by using a scandalous story involving U.S. President Barack Obama and racism. Cyber-criminals know people are curious by nature and take advantage of this to trick users and infect them with their creations.”
Users are advised to be on the lookout for such Twitter messages even if they come from friends. Now that President Obama has won the elections, it’s likely that we’ll stumble upon similar scams in the future.