Twitter 'Profile Spy' Worm Spreads Virally Through Tweets

A new Twitter worm that promises to provide a glimpse at who as viewed your profile is making its way through the microblogging network.

The worm spreads by automatically tweeting a link to a fake Twitter app called "Profile Spy." The link is accompanied by text that reads, "Wow! See who viewed your twitter with Profile Spy" followed by a link.

If a user clicks the link and approves the phony app, two automated tweets are posted to the infected account. The first announces how many people have viewed this particular profile: "53 people viewed my profile today," for example. (HoneyTechBlog reports that this number is likely random). The second tweets a link to Profile Spy.

F-Secure CRO Mikko Hypponen has notified the Twitter community about the worm. "Warning! Do NOT click on Twitter links about 'See who viewed your twitter with Profile Spy', do NOT authorize the 'Profile Spy' Twitter app," he tweeted.

Nevertheless, a Twitter search reveals that the worm is still spreading fast.

Comments

[WritersWithCats]

09:46 AM on 04/05/2011

Be EXTREMELY careful which applications you allow Twitter access to. When Twitter warns you about allowing access, remember that this application will RECORD YOUR USERNAME and PASSWORD on Twitter. =( Be very careful. Google search Twitter applications you come across, and check that they are viable, and have no bad feedback or reports. >^^

[Barry Bonham]

09:42 AM on 04/05/2011

Like all really succesfull scams, this one appeals to the vanity hidden deep within all who lack the spiritual acuity to recognize such things

[digitalmedusa]

10:09 AM on 04/05/2011

Brilliant response! I'm going to share this on Twitter and Facebook - it's too good not to.

[technobaboy]

10:13 PM on 04/04/2011

thanks for the heads up. i am new to twitter and things like these help. to echo the queries of the other readers, what does the worm do?

www.technobaboy.com

[Th3 5p3ctr3]

05:28 PM on 04/04/2011

Protip: Profile spreader worms like the ones on FB and the few hitting Twitter, are often a web-stored app hosted on someone's server. The only publicly accessable end of it is the infected account, which is, in reality, just custom configured to allow the app (The virus on the enemy web server) to access it.

As such, if it has not executed any payload yet, no one would be able to discover what that payload -is-. It's not the reporters fault that you know nothing about virus/worm structure and behavior.

[Jenna Brennan]

05:21 PM on 04/04/2011

So what does the worm do, other than spread itself? Seems harmless, if annoying.

[Larry Kelly]

12:36 PM on 04/04/2011

So what does the damn thing do once a person is infected? #crappyreporting

[Jenna Brennan]

05:22 PM on 04/04/2011

Hah Larry you said it better than I did. If Id seen your comment first, I wouldn't have bothered to respond. Nice one.

[itsjimmy]

11:50 AM on 04/04/2011

People on Twitter are naive and don't do what their told anyways.. They'll click on anything. At least the people that have a good knowledge of computers will stay away.. sadly, that number is less than the number of uninformed people.