Researchers Discover Malicious Campaign That Spreads Malware Via YouTube

Cybersecurity researchers have uncovered a malicious campaign that is distributed via YouTube channel with more than 1.8 lakh subscribers. 

Researchers have identified multiple cases of infections via malicious Tor Browser installers spread via explanatory video about Darknet on YouTube.

This YouTube channel has close to 2 lakh subscribers, while the view count on the video with the malicious link exceeds 64,000.

Through this malicious campaign cybercriminals spread malware to collect users’ personal data and obtain full control over the victim’s computer by placing a link to an infected version of Tor Browser in the description bar of a video about Darknet. 

Most of the affected users were from China. As the Tor Browser website is blocked in China, individuals from this country often resort to downloading Tor from third-party websites. And cybercriminals are keen on spreading their malicious activity via such resources.

The analysed version Tor Browser is configured to be less private than the original Tor - it stores browsing history and all the data user enters into website forms. Additionally, it distributes spyware to collect various personal data and send it to the attackers’ server, Kaspersky research revealed.

In a statement, Georgy Kucherin, a security expert at Kaspersky said, “Today we witness how video content is replacing texts, while video platforms are more often used as search engines. Cybercriminals are well aware of the current web consumption trends, hence they started to distribute malware on popular video platforms. This trend will stay with us for some time, that is why highly recommend installing a reliable security solution to stay protected against all potential threats.”

To reduce the risks of becoming a victim of a similar malicious campaign, do not download software from suspicious third-party websites, experts suggest.