A number of users of the Elon Musks X platform in India have complained of receiving strange or uncharacteristic direct messages (DMs) in which they were urged to vote for the sender. The DMs come with a link to help the sender win a prize opportunity or a contest. While many might not register such requests as a security threat, several of them have raised concerns on the ongoing scam and the safety of their accounts.
WHAT IS THE SCAM?
The vote-for-me scam is a phishing attack in which the perpetrator tries to get hold of the victim’s private credentials by sending them direct messages which appear to come from trusted legitimate sources. Users receive unexpected DMs from accounts asking them to click on the link and vote for the sender to help them win a podcast-related opportunity. Scammers have been using this habit to urge users into the trap as low-effort call to action. They also use company names like Google and Spotify to lend a sense of legitimacy to the scam. Once the link is opened, the user is taken to a sign-in page where they’re asked to enter their X name and username and password. Unknowingly, they land into a fake page which is used to harvest the user’s credentials in order to take over their accounts. These ‘vote-for-me’ requests appear to come from both verified and non-verified handles.
Multiple sources have received messages from seemingly hacked accounts, with police officers in Kashmir taking note of the matter and issuing a general warning.
HOW SHOULD USERS RESPOND?
On receiving such messages from unknown or unverified accounts, users should not click on the links and should not enter their usernames, nor should enter their usernames or passwords into the website unless they are signing into the official X platform. In case you receive a vote for me message from a user who do not, who you do not know, block the account and do not engage with the sender. In case if the message comes from a person whom you know, reach out to them via other channels or personally and verify if their account has been compromised or they have sent them on purpose. X has also warned users about fake emails that appear to originate from its company, urging users to reach out to help and not download any attachments from such emails.