We have detected a new Twitter spam campaign that may compromise user security. Users receive a direct message on Twitter, which contains the text “Check out Obama punch a guy in the face for calling him a nigger”, and a malicious link to a fake Facebook page.

If you click the link, you will be taken to a bogus Facebook page where you are prompted to submit your Twitter login details. However, if you enter your credentials, the malware will hijack your account in order to send the same malicious message to all of your followers.

Then, you will be taken to a website that displays a fake YouTube video set against a fake Facebook background. This time, you will be asked to update a ‘YouTube player’ to watch the video. As is usual in this type of scam, if you click on the ‘Install’ button, you will find yourself downloading the Koobface.LP worm, which will infect your computer and steal all of your personal data.

This attack exploits the two most popular social networking sites, Facebook and Twitter, to trick users into believing they are viewing a trusted site.  It also relies on its victims’ curiosity by using a scandalous story involving U.S. President Barack Obama and racism. Cyber-criminals know people are curious by nature and take advantage of this to trick users and infect them with their creations.

Twitter Direct Messages, Yet Another Technique to Spread Malware Infections

This is just the latest example of a cyber-scam that uses Twitter direct messages to spread. Users’ accounts receive dozens of them every day, with malicious links and enticing messages like: “What exactly do you think you’re doing on this video clip”, “Hello this guy is saying bad rumors about u…”, “Did you see this pic of you?”, etc., etc.

Never, ever, click the links within the text of those messages as they could infect your computer.  Every time you receive a direct message you should check with the sender that they have knowingly sent it to you. Make sure it has not been automatically forwarded to you from a hacked account. As a general rule, always keep your antivirus software up to date and be wary of messages offering sensational videos or unusual stories as, in 99 percent of cases they are designed to compromise user security.