Tweet by grinich

July 5, 2025

@irvinebroque @X Great question! The malicious link resolves to a redirection server that checks the user agent. If it’s “Twitterbot” (used for creating previews) it will redirect to Google Calendar. See screenshot. But when it’s your real browser, it will redirect to the attack URL. Sneaky! https://t.co/PUuHdxfJX3

Author
grinich
Date
July 5, 2025