- YouTube creators are being threatened with copyright claims
- The way to resolve the problem is to share a download link
- The link distributes trojanized programs that install a cryptominer
Cybercriminals have been targeting YouTubers with fake copyright claims, threatening them into distributing malware through their videos and channels. T
Cybersecurity researchers at Kaspersky recently spotted the campaign in the wild, claiming the majority of the victims are Russian.
Kaspersky said it spotted a video with more than 400,000 views sharing the malicious link, and that the campaign resulted in more than 40,000 downloads (before being pulled down).
Tens of thousands of downloads
Kaspersky said Windows Packet Divert (WPD), a user-mode network packet capture and injection tool for Windows, is growing increasingly popular in Russia. It allows applications to intercept and modify network packets at various stages in the Windows network stack, and is used as part of a tech stack that allows users to bypass government censorship.
There are many YouTube video tutorials on how to use WPD tools to do just that, and their creators are being targeted. Apparently, threat actors would file a copyright claim with YouTube, and then reach out to the creators, claiming they were the tool’s owners. They would then demand the creators add the tool’s GitHub download link in the videos’ description.
Alternatively, they would just reach out to the creators claiming to be the developers and offering an “updated” download link.
However, the GitHub repository being shared this way is trojanized and includes a version of the tool that carries a cryptocurrency miner called SilentCryptoMiner. This is a modification of the infamous XMRig, and is capable of mining ETH, ETC, XMR, and RTM.
“According to our telemetry, the malware campaign has affected more than 2,000 victims in Russia, but the overall figure could be much higher,” Kaspersky said in its analysis.
Cryptojackers are a popular type of malware which can be easily spotted, since the device running it cannot do anything else, as its compute power is fully utilized in the mining process.
Via BleepingComputer
Leave a comment