This screenshot shows a phishing page in Arabic that promises to increase the number of followers for a social media account (likely Instagram, TikTok, or Twitter). The victim is asked to provide their username, password, and desired number of followers – a classic credential‑harvesting scam.
Threat Analysis: Social Media Follower Booster Phishing – Credential Harvesting
How it works:
The victim encounters an ad, email, or direct message promoting a free or cheap service to gain thousands of followers instantly. The link leads to this page, which asks for:
- Username (social media login name)
- Password
- Desired number of followers (to make the offer seem customizable)
After the victim submits this information, the attacker captures the credentials. The victim may be redirected to a fake “processing” page or asked to complete a “verification” (e.g., a human verification survey), but the damage is already done.
The goal:
The attacker steals social media account credentials to:
- Take over the account and lock out the original owner
- Post spam, scams, or malicious links from a trusted account
- Use the account to send phishing messages to the victim’s followers
- Sell the account or its data on criminal markets
Red flags to watch for:
- Suspicious URL: The page is hosted on a domain that is not the official social media platform (e.g., not
instagram.com,tiktok.com, ortwitter.com). - Request for password: No legitimate follower‑boosting service requires your account password. This is always a scam.
- Too good to be true offer: Promises of instant, free, or cheap followers are classic lures for credential theft.
- Poor design and generic Arabic phrasing: The page lacks the branding and security features of the real platform.
What to do if you encounter this:
- Do not enter your username or password.
- If you have already entered your credentials, change your password immediately on the real social media platform. Enable two‑factor authentication (2FA) if available.
- Report the phishing page to the social media platform being impersonated.
Protective measures:
- Never share your password with any third‑party service claiming to boost followers, likes, or views.
- Use a password manager – it will not autofill on fake domains.
- Enable two‑factor authentication on all social media accounts.
- Be suspicious of any unsolicited offer that promises easy growth for your account.