Twitter Malvertising Phishes For Those Who Desire the Blue Checkmark

Go ahead. Admit it. You want that blue checkmark next to your Twitter handle too. Just like the highly sought celebs. A current scam going around on Twitter is using the desire for others to have that prized indicator next to their handles too. An account called @TweetsNews80 was luring people to a phishing scam using Twitter’s advertising platform. Well, unfortunately most of us cannot have them because they are indeed reserved for public figures and others at risk for impersonation. However, they are significant because they help other Twitter users feel more confident that those really are who they claim to be. And that may be used to lure unsuspected Twitterers into traps.

First, an explanation of the checkmark because it is important to know what it indicates. It can only be applied by Twitter. If you ever see a claim that someone else can do it for you or even help you get one, it’s a scam. According to Twitter’s help site, that indicator is reserved for “accounts maintained by users in music, acting, fashion, government, politics, religion, journalism, media, sports, business, and other key interest areas.” The general public does not receive these, but Twitter also does not endorse accounts with the badge either. They are just trying to ensure those users are who they claim to be. It’s always in the same place; next to the user’s name, is always the same color. So if you are perusing your Twitter feed and see that checkmark on your favorite politician’s feed in a different place, that’s probably someone impersonating that politician. It doesn’t always mean there’s a scam involved, but it could.

Always use caution when clicking on advertisements no matter where you’re browsing. Certainly not all of them are malicious, but many are. They may not just direct you to a site to enter information, but some of them immediately download malware to your device. Instead of clicking, go directly to the company’s website and look for the service or item there.

Now we move on to the scam. Users who clicked on this particular malvertisement were directed to a fake site posing as Twitter, but the domain name—the name before the .com in most cases—was different. In most other ways, including the fonts used, it looked like an official part of Twitter. However, users were sent to a page and prompted for information including their email addresses, passwords, and payment card information.

Tweets like this can happen because Twitter (as well as Facebook and Google) uses automated advertising purchasing tools. They don’t vet every person or company who wants to place an ad. This is how Kremlin-linked actors were able to utilize Facebook, Twitter, and Google to purchase ads that some say influenced the 2016 presidential election.

Twitter is working on ways to prevent manipulation of this advertising method including a verification form that is to help establish authenticity. However, a wholly appropriate solution is still to be determined. There are human actors who can and do remove flagged ads, but as is expected many fall through the cracks. Once contacted about this malicious ad, Twitter removed the tweet in question and the account that posted it. However, that was after it had been up for at least two hours.

If you think you may have fallen for this or another, go to Twitter's help center and report it.