The compromised profiles have been used to advertise shady diets

Sep 24, 2012 09:05 GMT  ·  By
Acai Berry diet website advertised via compromised celebrity Twitter accounts
   Acai Berry diet website advertised via compromised celebrity Twitter accounts

Cybercriminals will often take over Twitter accounts and use them to attract as many users as possible to their malicious websites. However, spammers and phishers are well aware of the fact that nothing can ensure the success of a campaign as the hijacked account of a celebrity.

The large number of Twitter followers makes public figures such as pro wrestler John Morrison (over 500,000 followers), WWE’s John Cena (2.7 million followers), The Usos team (125,000 followers), comedian Steve-O (close to 600,000 followers), and actor Donnie Wahlberg (368,000 followers) a tempting target for hackers.

In the past few days, all of them witnessed cybercriminals taking over their profiles and using them to advertise shady pharmaceutical products.

“Sorry guys, guess some attachments got sent out thru my account. I’m been a victim of #twithackery,” John Cena tweeted after noticing the incident.

“My account was hacked, if you got a DM from me, don't click the link & don't buy any damn diet pills!” John Morrison wrote.

Donnie Wahlberg – the actor from Saw – explained, “Apparently my account was hacked over the weekend. Sorry for whatever the hackers tweeted.”

Security experts from GFI Labs have analyzed this campaign. They reveal that messages advertising “the Best diet pill to lose 30 pounds in 1 month” lead to a shady website called ycche.branchmedianews.com.

The site – which relies on the names and reputations of various media outlets to make everything as legitimate-looking as possible - advertises Acai Berry diets.

Most likely, celebrities aren’t the only ones whose accounts have been compromised to take part in this operation so, if you’re one of the victims, be sure to immediately change your password and delete all the spammy tweets.

As far as public figures are concerned, it’s clear that many of them still haven’t learned the importance of strong passwords or the necessity for best online security practice.