YouTube has long been a hunting ground used by hackers and scammers to push all manner of hoaxes, scams and malicious code onto unsuspecting users. A security researcher known only as Frost is working for Cluster 25.
Frost has reported a significant uptick in the number of malware campaigns orchestrated from YouTube.
Overwhelmingly these campaigns are pushing Trojans onto the PCs and smart devices of their victims.
Frost has identified what appear to be two clusters of malicious activity occurring simultaneously. One of these is pushing the RedLine trojan and the other is pushing Racoon Stealer.
Literally thousands of videos and channels have been made in the conduct of these two campaigns. Based on Frost’s personal observation the campaigns are adding 100 new videos and 81 channels every twenty minutes.
He had the following to say about the identified campaigns:
The videos in question cover a wide range of topics. The hackers behind the campaigns tend to favor videos about software cracks, how to guides that outline how to get around software licenses, cryptocurrency, software piracy, game cheats and VPN software.
The videos are at least vaguely helpful and contain a link that the video’s authors claim is to a tool that will help the viewer on his or her quest related to the topic of the video. Naturally the link is nothing of the sort and clicking on it will install malicious code on the viewer’s device.
The problem has gotten serious enough that YouTube’s owner Google made a formal statement about the matter.
Google’s statement reads in part as follows:
“We are aware of this campaign and are currently taking action to block activity by this threat actor and flagging all links to Safe Browsing. As always, we are continuously improving our detection methods and investing in new tools and features that automatically identify and stop threats like this one. It is also important that users remain aware of these types of threats and take appropriate action to further protect themselves.”
The moral of the story is simple: Be very careful about any links you click.
