Twitter warns of suspicious traffic coming from China, Saudi Arabia

Suspicious traffic to a Twitter Inc user forum appears to be part of a government-backed activity coming from China and Saudi Arabia, a Twitter spokesman told Reuters via email on Monday.

The company does not know the reason for the activity, but notified users earlier on Monday out of an abundance of caution, the spokesman said.

Twitter Inc shares fell almost 7 percent after the company said it was investigating unusual traffic that might be from state-sponsored hackers and, in what appeared to be an unrelated issue, a security firm said hackers used the platform to try to steal user data.

Twitter said in a blog that it discovered suspicious traffic to a customer-support forum while investigating a security bug that exposed data, including users' phone country codes and details on locked accounts. It said the bug was fixed November 16.

Twitter observed a large amount of traffic to the customer support site coming from individual internet IP addresses in China and Saudi Arabia. 

Wedbush analyst Michael Pachter blamed the decline on concerns that news of a breach could hurt growth and user engagement.

"Clearly, a breach like this impairs user trust in the platform," he said. 

Separately, security software maker Trend Micro Inc said in a blog earlier on Monday that attackers sent out two tweets in October in a bid to steal data from previously infected machines. 

The hackers hid instructions in tweeted memes that secretly ordered infected devices to send information, including user names, screen images and other content, Trend Micro said.