According to the new report shared by the Google’s Threat Analysis Group (TAG) that highlights an ongoing phishing campaign against YouTube creators, which typically results in the compromise and sale of channels for broadcasting cryptocurrency scams.
The TAG attributes the attacks to a group of hackers who are recruited in a Russian-speaking forum, who basically hack the creator’s channel by offering fake collaboration opportunities and once hijacked, the YouTube channels are either sold to the highest bidder or used to broadcast cryptocurrency scams:
“A large number of hijacked channels were rebranded for cryptocurrency scam live-streaming. On account-trading markets, hijacked channels ranged from $3 USD to $4,000 USD depending on the number of subscribers.”
The YouTube accounts are reportedly being hacked using cookie theft malware, which is a fake software configured to run on a victim’s computer without being detected. While TAG also reported that the hackers also changed the profile pictures, names, and content of the YouTube channels to impersonate large tech or cryptocurrency exchange firms.
According to Google, “the attacker live-streamed videos promising cryptocurrency giveaways in exchange for an initial contribution.” The company has invested in tools to detect and block phishing and social engineering emails, cookie theft hijacking, and crypto-scam live streams as a countermeasure.
Given the ongoing efforts, Google has managed to decrease the volume of Gmail phishing emails by 99.6% since May 2021. “With increased detection efforts, we’ve observed attackers shifting away from Gmail to other email providers (mostly email.cz, seznam.cz, post.cz and aol.com),” the company added.
On the other hand, Google has shared the above findings with the Federal Bureau of Investigation (FBI) of the United States for further investigation.
