Mar 13, 2023Ravie Lakshmanan
Threat actors have been increasingly observed using AI-generated
YouTube Videos to spread a variety of stealer malware such as
Raccoon, RedLine, and Vidar.
“The videos lure users by pretending to be tutorials on how to
download cracked versions of software such as Photoshop, Premiere
Pro, Autodesk 3ds Max, AutoCAD, and other products that are
licensed products available only to paid users,” CloudSEK
researcher Pavan Karthick M said[1].
Just as the ransomware landscape comprises core developers and
affiliates who are in charge of identifying potential targets and
actually carrying out the attacks, the information stealer
ecosystem also consists of threat actors known as traffers[2]
who are recruited to spread the malware using different
methods.
One of the popular malware distribution channels is YouTube,
with CloudSEK witnessing a 200-300% month-over-month increase in
videos containing links to stealer malware in the description
section.
These links are often obfuscated using URL shorteners like Bitly
and Cuttly, or alternatively hosted on MediaFire, Google Drive,
Discord, GitHub, and Telegram’s Telegra.ph.
In several instances, threat actors leverage data leaks and
social engineering to hijack legitimate YouTube accounts and push
malware, often targeting popular accounts to reach a large audience
in a short span of time.
“Uploading to such accounts lends video legitimacy as well,”
Karthick explained. “However, such Youtubers will report their
account taker to YouTube and gain access back to their accounts
within a few hours. But in a few hours, hundreds of users could
have fallen prey.”
More ominously, anywhere between five to 10 crack download
videos are uploaded to the video platform every hour, with the
threat actors employing search engine optimization (SEO) poisoning
techniques[3] to make the videos
appear at the top of the list.
Threat actors have also been observed to add fake comments to
the uploaded videos to further mislead and entice users into
downloading the cracked software.
WEBINAR
Discover the Hidden Dangers of Third-Party SaaS Apps
Are you aware of the risks associated with third-party app
access to your company’s SaaS apps? Join our webinar to learn about
the types of permissions being granted and how to minimize
risk.
The development comes amid a surge in new information stealer
variants like SYS01stealer[5], S1deload[6], Stealc[7], Titan[8], ImBetter[9], WhiteSnake[10], and Lumma[11] that are offered for
sale and come with capabilities to plunder sensitive data under the
guise of popular apps and services.
The findings also follow the discovery of a ready-to-use toolkit
called R3NIN Sniffer[12] that can enable threat
actors to siphon payment card data from compromised e-commerce
websites.
To mitigate risks posed by stealer malware, users are
recommended to enable multi-factor authentication, refrain from
clicking on unknown links, and avoid downloading or using pirated
software.
Found this article interesting? Follow us on Twitter [13] and LinkedIn[14] to read more exclusive
content we post.
References
- ^
said
(cloudsek.com) - ^
traffers
(thehackernews.com) - ^
search
engine optimization (SEO) poisoning techniques
(attack.mitre.org) - ^
RESERVE YOUR SEAT
(thn.news) - ^
SYS01stealer
(thehackernews.com) - ^
S1deload
(thehackernews.com) - ^
Stealc
(thehackernews.com) - ^
Titan
(thehackernews.com) - ^
ImBetter
(blog.cyble.com) - ^
WhiteSnake
(blog.cyble.com) - ^
Lumma
(blog.cyble.com) - ^
R3NIN
Sniffer (blog.cyble.com) - ^
Twitter
(twitter.com) - ^
LinkedIn
(www.linkedin.com)
Read more https://thehackernews.com/2023/03/warning-ai-generated-youtube-video.html