Cybercriminals are hijacking popular YouTube channels to scam viewers.
Known as “Stream jacking,” the criminals take over channels, impersonate well-known figures to push fake investment deals and irresistible offers.
In this chat with Ionuț Baltariu (Bitdefender), we explore what-you-need-to-know about these dangerous schemes and how to protect your money from falling into the wrong hands.
—–
▶️00:47 – What is Stream Jacking?
01:12 – Stealing YouTube channels for malicious purposes
01:33 – Financially motivated
▶️01:47 – Who’s behind Stream Jacking?
01:47 – Different threat actors specialize in stages of scams (e.g. stealing YouTube credentials /creating fake videos).
02:12 – The tools for each stage act as building blocks for scams. The easy access to tools lowers the barrier for scams
▶️How does the scam work?
1️⃣02:44 – First stage – hijack youtube channel. (Different methods: Malware, phishing, data breaches)
2️⃣03:38 – Second stage – lure youtube subscribers to click on link (which lead to a scam website).
03:59 – The scam is subtle: featuring popular figures & quality user interface.
04:42 – Scammers hijack as many YouTube channels as possible to repurpose them, via impersonations or trending events to gain trust.
05:29 – Scammers exploit the heightened interest in cryptocurrency
05:52 – Detecting the genuine vs hijacked youtube channels. Scammers closely mimic the official channel, even copying playlists.
06:54 – With a large subscriber base, even a small percentage falling for the scam produce material financial gains.
07:25 – A key attraction for victims is the promise of doubling their investment.
07:43 – Scammers also use deep fakes of trusted figures (e.g. Elon Musk claiming to give back to the community)
08:26 – Detecting advanced deepfakes could be challenging
3️⃣08:54 – Third stage – lure victims to send money. (“promises” of doubling investments)
09:54 – fake transactions that claim to be from users in a giveaway.
10:11 – the source code reveals scripts that generate random wallets.
10:38 – Detecting a phishing site for a normal user is challenging.
▶️10:51 – Basic advice? Beware if it’s too good to be true
▶️11:16 – Basic detection measures?
1️⃣11:17 – Deepfakes red flags – e.g. unnatural hand movements, out-of-synch voice
2️⃣12:13 – Channel IDs – Check for old versions of the channel to evaluate if it’s been hijacked
3️⃣13:14 – Transactions – Verify on public blockchain sites to confirm authenticity
▶️13:45 – Scam crime statistics
13:45 – Hijacked youtube channels subscriber base – range from ‘000s to millions.
15:02 – Estimates of financial gains – hundreds of thousands
16:29 – Net profits – attractive due to reasonably priced scam toolkits
▶️17:38 – Social engineering attacks beyond email phishing
17:50 – Besides youtube, other social media platforms have also been exploited
18:21 – Other emerging hijacking attacks: “malvertising”. Exploiting our vulnerabilities (e.g. psychological, emotional)
—–
Ionuț Baltariu is a Software Engineer and blog author in the Threat Intelligence and Risk Analytics team at Bitdefender. His aim is to limit the impact of threats that spread through social media, so he is hunting daily for account takeovers, malware and “malvertising” on platforms. While not hunting, Ionuț takes part in the development of internal automation systems and on various risk assessment products.
—–
Recorded 20th September 2024, 12noon, Bsides Singapore.
—–
Stay with us:
LinkedIn ➡️ https://www.linkedin.com/in/lojane/
YouTube ➡️ https://cutt.ly/U2B0yVi
—–
#misscyberpenny
#cybersecurity
#cyberthreats #deepfakes
source
