Look like you lost weight in this video? It’s a Twitter phishing attack

Twitter lost weight phishingThe latest phishing attack is striking Twitter users by sending them messages saying that they’re fat.

Well, at least that’s how some people will interpret the message that’s being sent via DM (direct message) from compromised accounts:

you look like you lost weight in this video.. [LINK]

If you’re curious, you might click on the link which will take you to what appears to be the standard Twitter login page.

Sign up to our free newsletter.
Security news, advice, and tips.

Twitter phishing site

Hang on. Let’s take a closer look at the URL to see if this is really the Twitter login page.

Twitter phishing site URL

Hmm.. If your brain is running on autopilot, or if you’re simply seeing red at the suggestion from your friend’s message that you’re fat, then you might enter your Twitter username and password into the login form without thinking (after all, you want to see that video – right?)

And if you do enter your details, you’ve been phished.

Let’s hope that you aren’t one of the many people who use the same password on other websites on the net – otherwise cybercriminals might not just be able to send spam from your Twitter account, they may also have just been handed the skeleton keys for other parts of your online existence.

That could mean that scammers can now steal your personal information for financial gain. Nasty.

Password chart

If you found your Twitter account was one of those sending out the phishing messages, you shouldn’t just change your password and consider if you are using the same password elsewhere. It’s also a sensible time to look again at how you choose your passwords.

For instance, it’s important that you don’t use a word from the dictionary as your password. It’s easy to understand why computer users pick dictionary words as they’re much easier to remember, but as I explain in this video a good trick is to pick a sentence and just use the first letter of every word to make up your password.


Password security is becoming more important than ever. Make sure that you’re taking the issue seriously, or suffer the consequences.

There’s some other house-cleaning you should do on your Twitter account too. Visit the Applications tab in “Account Settings”, and revoke access for any third-party application that you don’t recognise.

Follow me on Twitter if you want to keep up-to-speed with the latest threats, and learn how to protect yourself.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.