Let me break it down what's going on with this spam. 1./
2/ Reply spammers fight a cat & mouse games with platforms like #Twitter.
One way they get spotted is by the platforms examining links.
If spammers hammer a platform by sending the same link in a thousands replies to the same scam site, it's not hard to spot & scale blocking.
3/ Remember spam emails w/misspellings, weird names, blocks of garbage text, mixtures of words & numbers etc?
These were all tactics to avoid spam filtering done by looking at each of these things for patterns.
Each new filtering strategy = new workarounds.
4/ These incessant Twitter replies are doing the equivalent of old school email scammers.
They want targets to get curious & greedy like "oh cool look here's a website with an account that already has a balance...let me just log in & get rich!"
Who falls for this? Well...
5/ People greedily typing in the site URL & "logging in" see a big account balance!
1.5 million dollars in USDT
They are instantly rich!
But to get it out? Well looks like you'll need to talk to the scammers.
& maybe sign up for the "VIP plan"
6/ Here's the thing. Platforms don't just look at the text & links of posts for evidence of spamming.
(Reports help too)
They scrutinize things like IP addresses & tech used for account creation & posting.
Enough signals of badness & you can scale up blocking.
7/ Speculation: anti-bot filtering that should happen before anyone can create an account or post... is failing.
So spam accounts are posting like crazy.
Then avoiding #Twitter's secondary defenses (e.g. text & URL filters) by mucking up their URLs to be less blatant.
8./ Reply spam is a numbers game.
Hope some users see a reply. (e.g. 14 views on a 60k tweet ain't great but...)
Eventually you get one user ready to go the whole way & get conned.
Even if 99.99999999% of us don't, there's still potential for ROI.
9/ Now, here's the thing. You have seen this reply spam for a while because the network has been up before.
3/ We got a tip about a single bit of #Paragon infrastructure & my brilliant colleague @billmarczak developed a technique to fingerprint some of the mercenary spyware infrastructure (both victim-facing & customer side) globally.
#Paragon's carefully constructed image of being a clean mercenary spyware company that wasn't susceptible to abuses has been replaced by a more familiar tale of...
Abuses...
And #Italy is now saddled with an unfolding crisis around spyware abuse.
VPN advertising is the most common source of security misinformation that I encounter.
By far.
So many people misplace their trust in dubious consumer VPN products.
The industry is a scourge.
VPNs don't do most of the things that podcasters imply they do.
Security:
Coffee shop attacks on unencrypted logins are a thing of a decade ago.
VPNs won't stop even the dumbest spyware & phishing.
Privacy:
Advertisers still know it's you when you turn on a VPN... they use many other identifying signals from your device, like your browser & advertising IDs. Those don't change when you turn on a VPN.
Trust:
A lot of VPN companies are shady.... and the industry is consolidating fast around some questionable players with concerning histories.
When you turn on a VPN you entrust all of your data to those companies.