On Monday researchers from CloudSEK reported 3,207 applications that leaked Twitter Application Programming Interface (API) keys. These API keys allow the holder to perform actions on the behalf of the account, such as reading direct messages, liking and retweeting tweets, following other accounts, and altering account settings. With applications leaking API keys, an attacker could easily acquire control of large numbers of accounts to increase the effectiveness of a campaign.
Twitter has historically been abused for several social engineering attacks. Primarily, exploited accounts are used in phishing campaigns to add credibility to the attacks. More recently, however, misinformation campaigns have taken hold, and large numbers of hijacked accounts operate as bots spreading misinformation.
