Beware the Twitter Phishing Scam

GRRRRREATTTTT. I’ve managed to keep my eyes peeled for scammers pretty well up to this point, but I was really busy and tired yesterday, and wasn’t paying much attention to what I was doing.

Yesterday, I received an email from Twitter (sheesh, I get about 20 a DAY) from a follower. The message was this:

You can see the link looks suspicious: twitter.secure.bzpharma.net/login. Uh HUH. I didn’t notice it at first glance, though.

At first I was like, “Oh great, NOW what are people slandering me for??” My memory is kind of fuzzy here- I don’t *think* I clicked the link in the email. Maybe I did. I can’t remember if I actually signed in to my Twitter account. I hope I didn’t. I did a search on the link in that email, and this is what I found at Mashable, it’s a new Twitter phishing attack:

A Twitter phishing attack is spreading rapidly today, attempting to obtain Twitter logins via Direct Messages. If you receive a message reading “lol, is this you”, and linking to a site called “bzpharma”, do not click the link.

Users who do click that link and enter their details are inadvertently letting spammers take over their accounts, which are then used to spam the same Direct Message to all their friends.

If you’re receiving these messages, your account is not compromised, but if you find you’re sending them, make sure to change your Twitter (Twitter) password immediately.

The IT security firm Sophos released this video regarding the attack:

If you think your Twitter account has been compromised, CHANGE YOUR PASSWORD IMMEDIATELY! I have already received obscene spam from two of my Twitter followers, so their accounts are compromised.

The crappy thing about this is that, while Twitter knew of the phishing scam and attacks, and publicly warned people, they never send out emails to Twitter users… I don’t see why? I mean, if there’s an attack on the site, wouldn’t it be good to email everyone to tell them? I like Twitter and I like tech news, but I don’t wait breathlessly by the Twitter news feed to check for new scams every day.

As a policy, it is best to NEVER NEVER NEVER click on any link in an email anymore, ESPECIALLY if you have to sign in with a username and password. Just never do it, never. Better to be safe than sorry.

As for me, I did click the link in the email. I don’t *think* I signed in to Twitter, though. Instead, I looked up the link- the “pharma” word in it made it suspicious. But as a precaution, I changed my password right away.