Even Twitter isn't safe from phishing. Phishers are now targeting the microblogging service Twitter to promote a widespread phishing campaign tricking celebrities and other users into submitting their personal information for identity theft and other illegal activities, experts say.

Like similar phishing scams seen on Facebook and MySpace, the latest version of the Twitter attack targets numerous celebrities, including President-elect Barack Obama, Britney Spears, and CNN anchor Rick Sanchez, among others, who have claimed to have fallen for the scam.

Since the weekend, the phishing attack has appeared to evolve into a traditional malware campaign in which users are enticed to click on malicious links for sites that contain keystroke loggers and other information-stealing code, experts say.

"We've already seen it move to a very traditional kind of phishing attack," said Marina Merritt, Internet safety advocate for Symantec (NSDQ:SYMC). "As (attackers) get people to click that link, there are so many exploits."

Like traditional phishing attacks on other social networking sites, the Twitter messages seem to come from someone that the victim knows. The attackers send what appear to be personalized "tweets" containing a link to a Web site impersonating the Twitter login site. In fact, the link leads users to a fake login page designed to trick them into handing over their usernames and passwords. Twitter said that the phishing attack domain appears to originate from China. The news was initially broken Jan. 3 by blogger Chris Pirillo after he received one of the phony Twitter messages used in the attack. Since then, Twitter posted a security advisory on its site warning users of the scam.

Posted by Justin Payton in Adware, Spyware and Trojans at 14:57