These YouTube gaming videos are spreading malware

Date:
Fri, 16 Sep 2022 21:05:12 +0000

Description:
Malware logs into compromised YouTube accounts and uploads malicious video to their channel.

FULL STORY ======================================================================

A newly discovered malicious campaign that distributes the RedLine Stealer infostealer comes with a very interesting self-propagation mechanism, researchers have found.

Cybersecurity experts from Kaspersky uncovered new malware that logs into the YouTube accounts of compromised users and uploads a video to their channel, which distributes RedLine Infostealer.

A victim, ideally a PC gamer, finds a YouTube video on cracks, or cheats, for one of their favorite games: either FIFA, Final Fantasy, Forza Horizon, Lego Star Wars, or Spider-Man. In the videos description are links that claim to hold those cracks and cheats which, in fact, host multiple malware bundled together. Cryptojackers, infostealers

In the bundle is RedLine Stealer, one of the most popular infostealers nowadays, capable of stealing passwords stored in peoples browsers, cookies, credit card details, instant messaging conversations, and cryptocurrency wallets.

The bundle also holds a cryptojacker, essentially a cryptocurrency miner
which uses the computing power of the compromised endpoint to mine certain cryptocurrency for the attackers. Cryptocurrency mining usually requires significant GPU power, something most gamers usually have.

But perhaps most interestingly, the bundle has three malicious executables, used for self-propagation. These are called MakiseKurisu.exe, download.exe, and upload.exe. MakiseKurisu is an infostealer that grabs browser cookies and stores them locally. Read more

A nasty new infostealer malware is landing in email inboxes

Here's another good reason not to download pirated software

Protect against DDoS attacks with these solutions

Then, download.exe would grab the fake crack video from a GitHub repository, and hand it over to upload.exe, which would upload it to the victims YouTube account, after using cookies to log in.

If the victim isnt an avid YouTube user, or has notifications turned off, there is a good chance the malicious video could sit on their YouTube channel for a long time, before being taken down.

When the video is successfully uploaded to YouTube, upload.exe sends a
message to Discord with a link to the uploaded video, Kaspersky explains. Here's our rundown of the best firewalls available now

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/these-youtube-gaming-videos-are-spreading-malwa re/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)