Microblogging network Twitter is under attack from fast-spreading worm called ‘Profile Spy’ that promises to allow users to see who has viewed their profiles. Instead, it infects users’ accounts with automated tweets.
The worm spreads by tweeting a link to a tweet that says “Wow! See who viewed your twitter with Profile Spy.” This links to a fake Twitter app called ‘Profile Spy’.
Once a user clicks on the link, automated tweets start being posted from their account, including one that announces a particular number of people viewed the user’s profile that day.
Click on that link and users are subjected to a never-ending battery of pop-ups for surveys, car insurance ads, etc.
The attack is reminiscent of the kind of scams that have been appearing on Facebook for more than a year, promising users information about who viewed their online profiles.
Users hit by the worm could revoke Profile Spy’s access to their Twitter account data by editing their Profile settings on Twitter.
Thousands fall victim to Profile Spy scam
“Of course, there’s no such way to tell who has been reading your Twitter posts – but that hasn’t stopped thousands and thousands of Twitter users from clicking on the link, and granting ‘Profile Spy’ permission to post messages from their account,” says Sophos’ Graham Cluley.
“The motive for the scam is, unsurprisingly, to make money for the scammers behind it. They pop up a survey and demand that you complete it before they will reveal details of who has been viewing your Twitter messages,” he said.
Cluley added: “If you were unfortunate enough to grant the Profile Spy app access to your Twitter account, revoke its rights immediately by going to the Twitter website and visiting Settings/Connections and revoking the offending app’s rights.”
