spam twitter · 1 comment · 950 words · read ~5,142 times.
Back in June, I noticed a pretty insidious piece of Twitter spam. The "twoo.fun" website was claiming that it could tell you who visited your Twitter profile.
That's pretty enticing! It's what LinkedIn uses to drive its premium product. Perhaps it would tell me if a potential employer was looking at my profile? Or if my crush kept visiting it!??!?!?
So people visited the website and signed in with their Twitter account. Whereupon the app started posting spam. Something which looked like this:
The Twitter API does not have the functionality to record visitors to a profile. This app is lying to users. But it tells an interesting lie. And that encourages people to click on the spam and log in with their own account.
As soon as I spotted it, I reported it via the Twitter Insiders' programme. And, to their credit, they managed to shut it down pretty quickly.
And then it popped up again.
Don't know how this garbage got onto my account, but I've since changed my password and revoked any apps I don't recognize or haven't used in ages.
Do yourselves a favour, AVOID THIS LIKE THE PLAGUE!!
Warning - new spam app is spreading through Twitter.
Twoo .fun cannot tell you who visits your Twitter profile. It is a scam.
If you sign up, you give it *full* access to your account.
You need to immediately remove it at
x.com/settings/conne… pic.x.com/9OploQ13Oi
And Again
Praga....total..clicou fudeu.
Warning - new spam app is spreading through Twitter.
Twoo .fun cannot tell you who visits your Twitter profile. It is a scam.
If you sign up, you give it *full* access to your account.
You need to immediately remove it at
x.com/settings/conne… pic.x.com/9oploq13oi
And again.
olá pessoas que foram burras igual a mim e caíram no vírus, cliquem no link que esse cara disse e revogue a permissão
Warning - new spam app is spreading through Twitter.
Twoo .fun cannot tell you who visits your Twitter profile. It is a scam.
If you sign up, you give it *full* access to your account.
You need to immediately remove it at
x.com/settings/conne… pic.x.com/9OploQ13Oi
And again.
Apologies to anyone that has seen this Spam app tweeting without me knowing in the last couple of hours, I was unaware that this was a spam app, I have deleted all the tweets it posted and have revoked/removed access of it from my account, please don't make the same mistake as me
Warning - new spam app is spreading through Twitter.
Twoo .fun cannot tell you who visits your Twitter profile. It is a scam.
If you sign up, you give it *full* access to your account.
You need to immediately remove it at
x.com/settings/conne… pic.x.com/9OploQ13Oi
It has been grimly fascinating to see how it spreads through different communities and different language groups.
You can watch it spread in realtime using https://twitter.com/search?q=Twoo.fun&src=typed_query&f=live
It has since metastasised into a similar scam called AskForMe.me - again, you can see it worm its way through communities at https://twitter.com/search?q=askforme.me&src=typed_query
In this case, the spam specifically mentions other users and posts fake statistics about how long they've been viewing the profile.
I keep reporting this to Twitter. And they keep shutting it down. And it keeps popping back up!
I don't have access to Twitter's systems - but it seems to me like there are some easy ways to curtail this scam. At the very least blocking those two domains would force the spammers to keep moving to new hosts. Perhaps Twitter could look for new apps which suddenly start posting messages which are quickly marked as spam. Or they could do some fancy machine-learning to identify similarly scammy images.
At the moment, we don't know what the end-game is for this spam. Maybe is it "just" a worm and someone is having a giggle seeing how many people they can infect. Perhaps it is harvesting accounts hoping to sell them to other spammers. Or it could be slurping down the social graph for other nefarious purposes.
Either way, this has been going on for at least five months! I think I've done what I can to inform Twitter. In the meantime, I urge you to warn your followers about this spam.
If you've been infected with this Twitter scam, please visit https://twitter.com/settings/connected_apps to remove it from your account.
Update! Looks like this spam has been doing the rounds since 2018!
“Who visits your #Twitter profile” #spam app brings week of chaos | #Malwarebytes Lab blog.malwarebytes.com/cybercrime/201… by @paperghost #cybersecurity #infosec #socialmedia pic.x.com/4XPycLG2VG
One of the similar ones I spotted last time around actually adds people and phrases to the infected user's mute lists, and prevents them seeing that it's a scam.
More comments on Mastodon.