New Browser Cookie “Smash and Grab” Attack Targets YouTube Creators



Smash and Grab YouTube AttacksNew attack details from Google’s Threat Analysis Group show how cybercriminals are innovating ways to use an initial attack to aid in additional crypto scams.

Some cybercriminals don’t focus on attacks that are clear and direct – like ransomware, for example. In many cases, an initial attack is necessary in order to put in place the scam that actually makes them money. In a recent blog by TAG, the security researchers at Google spelled out details on a new attack aimed at tricking victims into “investing” in cryptocurrency.

To accomplish this, the scammers first needed to take over YouTube creators with a large number of followers. Their intent is to change over the creator's page to look like a crypto exchange that viewers could engage with via cryptocurrency giveaway scams.

The takeovers were facilitated using phishing attacks targeting creators using over 15,000 threat actor email accounts that were created specifically for this attack. The phishing emails solicited the creators to promote a new antivirus software.

Screenshot_2021-10-20_3.12.41_PM.max-1000x1000

 

 

 

Source: Google

YouTube creators were then pointed to a malware-laden landing page, provided a PDF in Google Drive, etc. that infected victim machines with a cookie-stealing form of malware. Once the target was infected, the cookie stealing malware would take browser cookies from the victim’s machine and upload them to the actor's command & control servers.

The cookies are used in a “pass-the-cookie attack” - a hijacking technique that enables access to user accounts (and often can bypass MFA) using the stolen session cookies stored in the scammer’s browser. Once the YouTube channels were accessed, they were rebranded as crypto exchanges that were promising cryptocurrency in giveaways, in exchange for a small fee (the scam).

While most organizations aren’t going to be the target of such scams (as you’re not in the business of promoting another company’s product on your YouTube channel), this scam does have the common elements in it necessary to succeed. A reason for the victim to engage, some level of credibility, obfuscation techniques to avoid detection, and – most importantly – an ability to reach the intended victim’s Inbox can all be very costly.

Organizations like yours need to have security measures in play that address those phishing attacks that are able to find their way passed security solutions designed to detect malicious content. It’s only by having users enroll in Security Awareness Training that the user themselves becomes a part of the organization’s security efforts, remaining equally vigilant looking for suspicious content that may be malicious.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews