# Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter App

Truncated DM links disguised as YouTube URLs chained Google logout/login phishing with OAuth app authorization, virally hijacking Twitter accounts to spam followers.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: slickrockweb
- Disclosed: 2019-10-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/643274
- Library page: https://bugbountylibrary.com/r/h1%3A643274
- Tags: area:web domain:web impact:ato impact:data-leak impact:mass-exploit kind:bounty platform:hackerone sev:high tech:oauth technique:chained technique:recon vuln:clickjacking vuln:open-redirect

**Target:** Direct messages and OAuth third-party app authorization flow
**Root cause:** DM link truncation after 38 chars hides the true destination of a long accounts.youtube.com SetSID URL, so a malicious redirect chain appears to be a YouTube video; the chain logs victims out of Google, phishes credentials, then lands on randomized OAuth authorize screens for attacker apps.
**Steps:**
1. Attacker sends DM containing long `https://accounts.youtube.com/accounts/SetSID?...continue=...getmorefollowers.biz...` link to reciprocal follows/open DMs.
2. DM renders truncated as `accounts.youtube.com/accounts/SetSI...` looking like a YouTube video.
3. Victim clicks; chain logs them out of Google and prompts re-login, capturing credentials via malicious Google app.
4. Redirect continues to `getmorefollowers.biz` then `freefollower.eu/redirect.php`, which randomly redirects to one of ~10 `api.twitter.com/oauth/authenticate?oauth_token=...` screens.
5. Victim authorizes the third-party app; app DMs the same link to all reciprocal follows, propagating virally.
**How found:** Researchers investigating a malicious account noticed DMs containing truncated links that appeared to be YouTube videos; short-circuiting the redirect chain at freefollower.eu/redirect.php from multiple VPNs and virgin browsers revealed the randomized set of ~10 malicious OAuth apps.
**Exploitation:** Precondition: victim follows sender or has open DMs. Clicking the truncated link runs a Google SetSID logout/login chain harvesting Google creds, then redirects through getmorefollowers.biz/freefollower.eu to a randomized OAuth authorize page; once authorized the malicious app mass-DMs the link to the victim's reciprocal follows, scaling the infection.
**Escalation:** Each compromised account auto-DMs the payload to its trusted reciprocal follows, creating exponential viral spread and mass OAuth app installation across thousands of accounts.
**Insight:** Link truncation in messaging UIs can mask the true host/path of long URLs; test whether a trusted-looking truncated prefix (e.g. accounts.youtube.com) can front an attacker-controlled redirect chain, and short-circuit redirectors to enumerate randomized downstream OAuth clients.