For those interested in maximizing the number of eyeballs on their posts on Twitter, paid promotion has been a handy option. Now cybercriminals are getting in on the action.

Yesterday, Twitter promoted a post by a phishing site claiming to offer Twitter verification but designed to steal credit card data. As Joseph Cox from The Daily Beast reports, “…The phishing site first presented a convincing looking, but fake, Twitter page that explained the merits of having an account verified—or certified as genuine by Twitter’s internal apparatus.”

Anyone lured to respond to the post was then asked for credit card and billing information–presumably for the cybercriminals to use elsewhere. According to Cox, the phishing site is now inactive and Twitter has suspended that account.

Read the full story at The Daily Beast.