Phishing attacks are a type of trick that people use to obtain account login details. They do this by getting you to click a link that goes to a fake replica of the site they want your login info for. They rely on people not paying close enough attention to detail and thinking that the site is real. When somebody tries to log in to this fake site, the attackers now have their credentials.

I am bringing this up because I have noticed a large number of people falling for this trick in twitter. The most common attacks going around right now seem to be “viral”. You will get a DM, probably from someone you know is a legitimate user. The message usually says something along the lines of “Look at this funny picture I found of you [link]”. If you click on the link in the message, you are taken to what appears to be the twitter login page. The attackers are hoping you will assume you got kicked off of twitter for some reason and that you will try to log back in. This is because this is not the real twitter login page; It is a fake. If you look at the url of this page it is not what it should be. The real twitter login page’s url should read “https://twitter.com”. This page reads “###jtter.com/session_verify” (I have blanked out a portion of this url as I don’t want to promote it). If you enter your credentials into this page, the attackers will now have them and will now use your account to send out the original “funny picture” message and the cycle continues.

These attacks are used to get login info for many different services. A very common one is online banking. The attackers will send you an email claiming to be your bank saying that you need to log in to your account for one reason or another. The email will have a link to a fake login page just like the twitter attack above.

There are many different ways to protect yourself from these attacks:

1. Never login to a page that was linked to you if it’s from an unsolicited message. 
2. Your bank will never send you an email asking you to login to their site with a link so don’t trust any emails asking this. 
3. Often times, phishing emails will have spelling and grammatical errors. 
4. Verify that the url of the website you are logging into is correct. 

If you follow the above rules, then there is no need to worry. Just remember that if you didn’t ask to receive a link to a login page, then don’t trust it. When in doubt, navigate to the website manually.

If you have any questions or comments, add them below!