Malicious code is being inserted into hundreds of Twitter feeds. And if you visit the Twitter.com site today, you could easily spread the malicious code yourself.
If your mouse simply passes over the link, it triggers a JavaScript code which automatically retweets the link to all of your followers. In addition, it "grays out" your entire home page, so your mouse is also prevented from clicking the link to "undo" that retweet. Hundreds of pages now contain the tweet with the malicious code. And below it, Twitter's standard text for a massively popular update: "Retweeted by yourself and 100+ others..."
The code is often lurking in the user name -- and sometimes the tweet itself is entirely blank. It can hijack clicks on the compromised page, taking users to a malicious non-Twitter site. PC Magazine reports that one affected user was the wife of a former British Prime Minister, whose Twitter feed now redirects users to a Japanese porn site. And CNN discovered another victim: White House press secretary Robert Gibbs. Tuesday he tweeted, "My Twitter went haywire - absolutely no clue why it sent that message or even what it is...paging the tech guys..."
"Worse things are possible," PC Magazine warns. But fortunately, there's one sure way to protect yourself. The malicious code does not affect users who access the site through a third-party Twitter application. Apparently these "Twitter clients" (like Hoot Suite and Tweet Deck) make it possible to delete any Tweets containing the malicious code. Of course, this might not work if Twitter deactivates your account in an attempt to stop the spread of malicious code. It's not clear what steps they'll be taking today to stop the spread of the virus. But hopefully, they'll implement a fix soon
