The rise of Tumblr and Google Play spam campaigns
In May, GFI threat researchers observed a number of attacks focused on Tumblr users including two spam campaigns centred around a fake “Tumblr Dating Game” which lead to surveys, fake advertising spam asking for personally identifiable information in exchange for ad revenue generated by the victim’s tumblelog, and a phishing site posing as the Tumblr login page.
“Tumblr continues to be a site that is well-trafficked by cybercriminals looking to victimise micro-bloggers with minimal effort,” said Christopher Boyd, senior threat researcher at GFI Software. “More and more, cybercriminals are exploiting the familiarity of terms and images in order to distract the victim from the dangers that are present as they sign away their personal information and click on links that lead to nothing but trouble.”
Multiple rounds of spam were encountered on Tumblr during May which directed users to a phony dating site that included pop-up ads meant to generate cash for the spammers whenever a user unwittingly signed up.
The fake dating site and the spam that directed users to it were rife with pop culture references including internet memes and an allusion to a slogan used by the British government during WWII which has become a popular catchphrase in recent years. These references were meant to fool potential victims into thinking the sites were legitimate and associated with internet content that they viewed as familiar.
Tumblr users were also targeted by a spam account which followed potential victims to gain their attention and redirected them to a fake Tumblr login page in order to steal the login information submitted by the user. Users who do not regularly sign out of their Tumblr accounts were less likely to notice that the phishing page was modelled after an outdated version of the Tumblr login screen.
Finally, Tumblr users were confronted with a relatively new form of Tumblr spam called “Tumblr Tasks” that promised to provide users with a kit to monetise their tumblelog in exchange for filling out a form and paying a small fee. This campaign leveraged the fact that Tumblr’s plans to advertise on the site have recently become a hot topic in the social media world.
Elsewhere, shoppers at Google Play looking for Android apps, e-books, movies and music files were faced with a large number of spam applications designed to lure users into installing them by exploiting the brand recognition of popular movie franchises, musicians, video games and stores.
Each of the malicious apps spammed the victim’s mobile device with surveys and advertising offers while failing to perform functions as advertised.
“Users can avoid an entire world of worry by simply checking the basic details when confronted with a link or offer from an unknown source. Cybercriminals are banking on the fact that social media users want to quickly share content and that they won’t thoroughly investigate links before spreading them to friends,” continued Boyd. “It is amazing how helpful little things can be when trying to keep yourself safe online. For example, holding the cursor over a link to check if it is directing you to the correct site, reviewing the basic details of an app before installing it on a mobile device or simply asking “is this offer too good to be true’ are basic yet impactful ways to identify and avoid becoming a victim of cybercrime.”