Researchers at ESET warn of phishing attacks that are attempting to hack high-profile YouTube channels in order to spread scams or malware.
“Attackers create fake websites and send emails that look like they are from YouTube or Google and attempt to trick the targets into surrendering their ‘keys to the kingdom,’” the researchers state.
“In many cases, they also tout sponsorship or collaboration deals as the lure – the message includes an attachment or a link to a file where the terms and conditions are said to be detailed. Nothing could be further from the truth, however, with the threat becoming even more acute where the accounts were not protected by two-factor authentication (2FA) or where attackers circumvented this extra safeguard.”
Attackers sometimes use bots to post thousands of videos encouraging people to download malicious software.
“In some scenarios, criminals hijack existing Google accounts and in the span of minutes create and post thousands of videos that distribute info-stealing malware,” ESET says. “People who fall victim to the attacks may end up having their devices compromised with malware that also steals their accounts on other major platforms such as Instagram, Facebook, X, Twitch, and Steam.”
ESET recommends that users implement multi-factor authentication and maintain a healthy sense of suspicion regarding unsolicited communications.
“Be skeptical of emails or messages claiming to be from YouTube or Google, doubly when they ask for your personal information or account credentials,” the researchers write. “Check the sender’s email address and look for signs of phishing. Just as importantly, avoid clicking on suspicious links or downloading attachments from unknown sources. The same goes for apps or other software that is promoted on YouTube unless they come from trusted and verified sources.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
ESET has the story.
