Trend Micro Incorporated has announced a new study revealing how cybercriminals are abusing Twitter via tech support scams, command-and-control (C&C) operations and data exfiltration.
Trend Micro researchers analysed a large volume of Twitter data to identify relationships between various entities to spot anomalies and uncover key insights.
“Social media is an inescapable part of modern life, and our new research shines an important light on how it’s being used positively by the security community, and abused by criminals,” said Tim Falinski, Managing Director, Consumer, APAC, Trend Micro. “This research shows businesses how the misuse of social networks can damage their brand, and it informs consumers how they might be tricked into a scam from what is believed to be a trusted source. We hope by making these abuses known, both businesses and consumers can be vigilant to not become victims of such attacks.”
Criminals were found using fake Twitter accounts to spoof those of legitimate vendors for credible tech support scams. Users call the fake phone number provided, believing they are speaking with the intended company’s help desk, which results in the caller either sharing credit card information or installing malicious content on their computer.
This is often part of a multi-platform strategy along with YouTube, Facebook, Telegram and other channels to improve SEO for fake tech support websites linked to the Twitter accounts, boosting their search rankings.
While criminals are using the social network for bad, threat researchers can leverage the power of social media for good. Most notably, Twitter is used for monitoring vulnerability disclosures to inform patch prioritisation, and scanning for indicators of compromise, threat detection rules, and other contextual information to boost threat intelligence.
Trend Micro recommends users confirm the validity of a Twitter account by checking the company’s website directly, rather than through the account. It is also important for security teams to validate Twitter data when leveraging it for investigations or threat intelligence.
Stock photo bigtunaonline/Bigstockphoto
