Fake anti-virus attack spreads on Twitter via goo.gl links

Graham Cluley
Graham Cluley
@[email protected]

Thousands of Twitter users are finding that their accounts have been tweeting out malicious links without their permission, pointing to a fake anti-virus attack.

A quick search on the popular micro-blogging network finds many tweets from users containing no message other than a goo.gl shortened link (Google’s equivalent to bit.ly or tinyurl), which itself points to a URL ending with “m28sx.html”.

Although most affected Twitter users appear to be oblivious to what has occured, a few have noticed the messages, and suspected a security breach.

Twitter users with accounts abused in fake anti-virus attack

Sign up to our free newsletter.
Security news, advice, and tips.

If you make the mistake of clicking on one of the malicious goo.gl links you are ultimately taken to a website which attempts to scare you into believing that you have a virus problem on your computer. You are then frightened into installing malicious code on your PC, and asked to pay money to disinfect your systems.

Sophos is adding detection of the malware as Troj/FakeAV-CMG. Sophos’s Live Protection technology has been protecting customers against the Ukranian URL hosting the malware since January 12th.

Interestingly, all of the offending Twitter messages examined by Sophos so far claim to have been posted by “Mobile Web” (Twitter’s “lite” interface for generic mobile phone users) rather than users’ normal clients such as Tweetdeck or Twitter for iPhone.

Goo.gl tweets

What isn’t yet clear is how the Twitter users found their accounts compromised in this way. The natural suspicion would be that their usernames and passwords have been stolen. It certainly would be a sensible precaution for users who have found their Twitter accounts unexpectedly posting goo.gl links to change their passwords immediately.

Remember, you should never use the same password on multiple websites.

Earlier this week Sophos published its 2011 Security Threat Report, revealing a sharp rise in the number of cybercriminal attacks taking place via social networks.

Download the Sophos Security Threat Report 2011

Update: Del Harvey of Twitter’s security team has confirmed the problem, and reports that the site is removing the dangerous links and resetting the passwords of compromised accounts.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.