UPDATED: 8 October 2012
Have you received a DM message like this recently?
or this
In each case you haven’t had your account “hacked”, but one of your friends has, and a spammer has got hold of their account via a fake Twitter login page.
This actually happened to a friend of mine recently so I had a chance to see what happens first-hand as I had set the account up for her.
If you click on one of these links, then what happens next is YOU will be hacked and then start sending spammy DM’s to all of your followers.
If people tell you they have received a spammy DM from you then you need to
IMMEDIATELY CHANGE YOUR TWITTER PASSWORD
What is happening is that the bit.ly link in the direct message that says “hey this person is making up offensive things that are about you http://bit.ly/xyzabcdefx” is redirecting you to a fake Twitter login page that looks like this (click for larger view).
By logging into this fake page, you then give your password to the spammer, and they take control of your twitter account and flood your friends with spam DM messages – allowing these links to spread like a virus. Your friends then click on them and the cycle continues.
Looking at the address on the fake page – it is twitvter.com – looks similar enough to twitter.com that you don’t think twice.
Looking at the whois domain record for this address, we can see that it is registered to someone in Shanghai and set up only a few days ago.
I am assuming that they keep setting up new domains as their scam is discovered and the websites get shut down.
Other steps to take to clean your account
Once you have changed your password, it is a good idea to also check which applications and websites have access to your twitter account.
Here is what you can do:
Step 1
On Twitter.com, click the dropdown under your name on the RHS of the page and select “Settings” (click for larger view)
Step 2
On the next menu select “Applications” in the left hand pane at the bottom (click for larger view)
Step 3
Click the “Revoke Access” button for each and EVERY application that is not essential (and definitely the ones you do not recognise).
The latest ones there could be the ones sending DMs on your behalf.
Step 4
Use a paid for and responsible tool such as @PeopleBrowsr (free 14 day trial) to manage your twitter presence.
Remember if the product is free, then the product is me (and thus your online reputation ).
Don’t look silly, de-authorise spammy apps NOW!