Well, Chris Boyd over at GFI Software explains. Profile Stalker is the next evolution of Tumblr spam. “There’s an application currently spamming itself across Tumblr accounts, using the tried and tested bait of ‘profile stalking’,” he reported on the company blog this morning. The profile stalker lure is compelling. Who wouldn’t want to know who’s been visiting their account? It’s been used in one way or another as scam bait on all of the social networks.
But this is a bit different. “Unlike other profile stalker scams we’ve seen where the so-called ‘app’ is really just a cookie-cutter website with a survey, this one is a cookie-cutter website with a survey and an installable application.” It’s installing the application that causes the problems, particularly the element that requires the user to “Grant this application read and write access to your Tumblr account.” Once that has been done, the scammer gets to write his own posts – usually surveys – on the victim’s Tumblr account.
First came spam via compromised accounts, “say, a phish that resulted in spamposts via compromised credentials,” explains Boyd. These could be stopped simply by resetting the victim’s password. “After that,” says Boyd, “the scammers started to make use of the ‘post by email’ feature.” If allowed, scammers could carry on spamming however many times credentials were changed – but not if the ‘post by email’ secret address was changed.
“Now we have rogue apps spamming, which is yet another way to end up with lots of confused Tumblr users asking ‘how do I stop this and where are my kitten gifs?’”, he explains. And then he provides the answer. gr8brittyn and every other Tumblr user who has fallen for the Profile Stalker scam needs to click the cog-like settings button and then click ‘Revoke access’ next to the Profile Stalker icon. And it’s gone.
But, he warns, this might be just the beginning. “Seeing applications become part of the battle is an interesting twist and it’s likely that this will be a new and exciting way to keep you from angry fandom posts and rageface memes for the foreseeable future.”