Twitter scam claims to get you more followers

A scam that has been making its way around Twitter for some time has resurfaced recently and promises to increase a user’s followers, but really gives control of one’s account to a questionable third party.

The ruse begins by employing some social engineering with a tweet that says “I will follow back if you follow me” and includes an shortened link. The link then takes you to a web site that offers a service which claims it can round up hundreds, even thousands, of new followers on a Twitter account.

According to Sophos’ Senior Technology Consultant Graham Cluley there are several versions of the services out there.

“Although the graphics differ, the basic template of the site remains the same — including options to either pay for a VIP plan or try out a free service that promises hundreds of new followers,” Cluley notes in a blog post.

[See also: 5 Twitter, Facebook scams to avoid and Social media risks: The basics]

Cluley created a new Twitter account to test out the service through a “free trial.” He quickly found the service required his Twitter username and password.

“That should instantly have you running for the hills — why should a third-party webpage require your Twitter credentials? What are the owners of these web pages planning to do with your username and password? Can they be trusted?” he said.

Cluley also noted in the bottom right hand corner of the site, the service admits it is not endorsed or affiliated with Twitter.

After entering the login details for the test account, Cluley reports he was asked by Twitter to grant the application access to the account, which many unwitting victims often do.

“Sadly, some people are too keen for new followers. And they pay the price in the form of a message promoting the followers service is posted to their feed. In this way, the links can spread rapidly between Twitter users.”

While the scam is making the rounds again, it is not a new one. Researchers at Zscaler explained the details of the ploy several months ago, noting some services ask for credit card numbers in exchange for VIP status, which promises 400-1,000 new followers a day. In reality, the compromised Twitter account is then used to send out Twitter spam to promote the service and follow hundreds of other accounts but result in no meaningful additional followers, according to Zscaler.

Cluley advised anyone who had fallen into the trap to revoke the application’s rights immediately in the Settings/Applications section of a Twitter account. Changing one’s password is also recommended, he said.

“If you take no action against attacks like this, don’t be surprised if the unknown parties who now have control over your Twitter account use it to commit crimes or cause a nuisance,” said Cluley.