When business tycoon Elon Musk completed his Twitter acquisition, one of his first tasks was to oversee the microblogging site’s review process. According to the order, a verification icon will be added to the Twitter Blue subscription, which initially costs $19.99 per month. Existing badge holders will have up to 90 days to start paying the new fee before they lose their verified badge.

As TechCrunch security editor Zach Whittaker recently observed, cybercriminals are already taking advantage of the proposed change by sending phishing emails to verified users:

The message, allegedly from Twitter, states that from November 2, 2022, the verification token will cost $19.99 per month for some users. If the buyer does not want to pay the monthly fee, he must confirm that he is a “known” person.

If the recipient clicks the “Provide Information” link, they will be asked to enter their Twitter username, password, and phone number. At this point, any information provided will be sent to cybercriminals for identity theft or financial transactions.

There are many signs that this is a phishing email. For starters, it comes from an address [email protected][.]com is not from the official Twitter domain. It also opens a Google Doc at the Google Sites URL instead of the official Twitter website.

Even “stupid” Elon Musk isn’t convinced yet that they’re going to charge $19.99 for the new verification system. This is author Stephen King’s response to his disgruntled tweet about not paying $20 to keep the blue check:

Google blocked the phishing site as soon as TechCrunch warned them. However, given that these scams came to light soon after Musk took over Twitter, more Twitter-related phishing campaigns are likely to emerge in the future.

To protect yourself from phishing attacks, always be careful when clicking links or downloading attachments from spam emails. Also, always check the URL of the site you are on; For example, if it doesn’t start with twitter.com, it’s probably a scam. Finally, enable two-factor authentication to ensure that attackers cannot access your account even if they have your username and password. Source