Thousands of Tumblr users' logins stolen in phishing attack
- Details
- Published on Wednesday, 29 June 2011 10:55
For the past few days users of microblogging site Tumblr have been targeted with phishing scams that require people to type in their login credentials to see adult content, GFI Labs warned today.
"The data we saw contained 8,200 lines of text stretched across 304 pages of Microsoft Word, and even accounting for the inevitable duplicates and fake data that's still quite the goldmine of pilfered login credentials," the post says.
The attack displays pages of Tumblr users whose accounts have been compromised and converted into fake login pages and the Web addresses are redistributed, the post says, adding that some of the compromised accounts were prompting people to login on that same page while others were redirecting people to a different Web site.
The problem has become so pervasive that Tumblr users set up anti-phishing sites to help prevent others from being duped, however, one of those sites was found to be directing to one of the servers being used by the attackers, according to GFI Labs. Several domains that were used in the scam are now inaccessible, the company said.
GFI Labs speculated that the stolen accounts might be harvested for use in some advertising affiliate scam or they could be tested to see if people have used the same credentials on other sites.
(CNET News)
