InfoSec Handlers Diary Blog – WITHOUT Internet Storm Center

[ad_1]

I noticed several videos posted on YouTube today attempting to direct users to cryptocurrency scam websites. The general trick is quite old: the scam promises that Elon Musk, or an organization associated with him, will give away cryptocurrencies. The catch: you must first send cryptocurrencies to the address to receive several in return.

It all starts with a video promising a live stream from Elon Musk covering current developments around SpaceX.

The channel used for these videos, SpaceXMission, currently has over 2 million subscribers and approximately 430 million views. Interestingly, this is not a new channel, but it started on August 25, 2008. Currently, around 4,000 users are watching “live streams”.

During the video, a QR code appears next to an image that purports to show a tweet from Elon Musk promising cryptocurrencies.

I blocked part of the QR code to prevent accidental reading. This leads to https://muskwa[y.]com, the site offers wallet addresses for different cryptocurrencies, promising twice your “money back” if you send money to these addresses.

The Bitcoin address used by the scam, 1G4aPzodQtdkLhiERK7VWM6vXYfQeSsAaP, has already received around 1.35 Bitcoin or $28,376.70 in 12 transactions. The muskway.com website also displays a “ledger” purporting to show incoming transactions and actual outgoing payments. It is unclear whether incoming payments to the Bitcoin address are from victims or were placed as bait to make the wallet more legitimate. But the payments shown on the fake ledger on muscway.com do not match payments based on blockchain.info. I assume the money sent to the address is from the victims.

Needless to say, I’m amazed that people still fall for these simple, well-known and apparent scams. But cryptocurrency users can represent a self-selected target group. YouTube appears to have already removed some of the accounts associated with this scam, but there appear to be new videos and possibly accounts popping up. The real “mystery” is the origin of the “SpaceXMission” account. I suspect it may have been used in the past for other spam and scams. But it could be an abandoned account later stolen or repossessed.

— Johannes B. Ullrich, Ph.D., Dean of Research, SANS.eduTwitter|

[ad_2]