Twitter’s verification chaos is now a safety drawback • TechCrunch

Cybercriminals are already capitalizing on Twitter’s ongoing verification chaos by sending phishing emails designed to steal the passwords of unwitting customers.

The phishing electronic mail marketing campaign, seen by TechCrunch, makes an attempt to lure Twitter customers into posting their username and password on an attacker’s web site disguised as a Twitter assist kind.

The e-mail is shipped from a Gmail account, hyperlinks to a Google Doc with one other hyperlink to a Google Web site, which lets customers host internet content material. That is more likely to create a number of layers of obfuscation to make it tougher for Google to detect abuse utilizing its automated scanning instruments. However the web page itself accommodates an embedded body from one other web site, hosted on a Russian internet host Beget, which asks for the consumer’s Twitter deal with, password and telephone quantity — sufficient to compromise accounts that don’t use stronger two-factor authentication.

The marketing campaign seems crude in nature, doubtless as a result of it was rapidly put collectively to benefit from the current information that Twitter will quickly cost customers month-to-month for premium options, together with verification, in addition to the reported chance of taking away verified badges of Twitter customers who don’t pay.

As of the time of writing, Twitter has but to make a public determination about the way forward for its verification program, which launched in 2009 to verify the authenticity of sure Twitter accounts, equivalent to public figures, celebrities and governments. However it clearly hasn’t stopped cybercriminals — even on the lower-skilled finish — from making the most of the shortage of clear info from Twitter because it went non-public this week following the shut of Elon Musk’s $44 billion takeover.

TechCrunch has alerted Google and Beget to the phishing pages, however didn’t instantly hear again. A spokesperson for Twitter didn’t instantly reply to a request for remark.