New attack details from Google’s Threat Analysis Group show how cybercriminals are innovating ways to use an initial attack to aid in additional crypto scams.
Some cybercriminals don’t focus on attacks that are clear and direct – like ransomware, for example. In many cases, an initial attack is necessary in order to put in place the scam that actually makes them money. In a recent blog by TAG, the security researchers at Google spelled out details on a new attack aimed at tricking victims into “investing” in cryptocurrency.
To accomplish this, the scammers first needed to take over YouTube creators with a large number of followers. Their intent is to change over the creator's page to look like a crypto exchange that viewers could engage with via cryptocurrency giveaway scams.
The takeovers were facilitated using phishing attacks targeting creators using over 15,000 threat actor email accounts that were created specifically for this attack. The phishing emails solicited the creators to promote a new antivirus software.
Source: Google
YouTube creators were then pointed to a malware-laden landing page, provided a PDF in Google Drive, etc. that infected victim machines with a cookie-stealing form of malware. Once the target was infected, the cookie stealing malware would take browser cookies from the victim’s machine and upload them to the actor's command & control servers.
The cookies are used in a “pass-the-cookie attack” - a hijacking technique that enables access to user accounts (and often can bypass MFA) using the stolen session cookies stored in the scammer’s browser. Once the YouTube channels were accessed, they were rebranded as crypto exchanges that were promising cryptocurrency in giveaways, in exchange for a small fee (the scam).
While most organizations aren’t going to be the target of such scams (as you’re not in the business of promoting another company’s product on your YouTube channel), this scam does have the common elements in it necessary to succeed. A reason for the victim to engage, some level of credibility, obfuscation techniques to avoid detection, and – most importantly – an ability to reach the intended victim’s Inbox can all be very costly.
Organizations like yours need to have security measures in play that address those phishing attacks that are able to find their way passed security solutions designed to detect malicious content. It’s only by having users enroll in Security Awareness Training that the user themselves becomes a part of the organization’s security efforts, remaining equally vigilant looking for suspicious content that may be malicious.
