Google unmasks the phishing and malware campaign targeting YouTube users two years ago

[ad_1]

Almost two years after a wave of complaints flooded Google’s support forums regarding YouTube account hijacking even though users had enabled two-factor authentication, Google’s security team has finally tracked down the root cause of. these attacks. From a report: In a report released today, the Google Threat Analysis Group (TAG) attributed these incidents to “a group of hackers recruited into a Russian-speaking forum.” TAG claimed that the hackers operated by contacting the victims via email with various types of business opportunities. YouTubers were typically drawn to potential sponsorship deals. Victims were asked to install and test various applications and then post a review. The apps generally used in these schemes involved antivirus software, VPN clients, music players, photo editors, PC optimizers, or online games.

But unbeknownst to their goals, hackers hid malware inside apps. Once the creators of YouTube received and installed the demo app, the installer dropped malware on their devices, malware that extracted login credentials and authentication cookies from their browsers and sent the stolen data to a remote server. Hackers would then use authentication cookies to log into a YouTuber’s account, bypassing the need to enter a two-factor authentication (2FA) token and moving on to change passwords, email, and recovery phone numbers. account. With victims locked out of their accounts, hackers typically sell the hijacked YouTube channel to underground markets for stolen identities.

[ad_2]