YouTube TV reaches deal with Disney to restore ESPN, ABC, more
Google reported it has tracked and disrupted an email phishing campaign tied to Russian-speaking hackers that has targeted YouTube users since 2019 as part of a cryptocurrency scam effort.
In a blog post published Wednesday, Google's Threat Analysis Group (TAG) detailed how the hackers had used "cookie theft malware" to compromise the YouTube accounts in order to hijack the channels, sell them or use them for broadcasting cryptocurrency scams.
The hackers, who Google said were recruited from a Russian-speaking "hack-for-hire" forum, used emails proposing faked collaboration opportunities with the YouTube channels to send malware or phishing email links to the users.
More than 1,000 domains - with some posing as COVID-19 news sites - were built for the purpose of this scam, and to fake social media pages. The malware used in the operation was capable of stealing user passwords and stealing cookies already in use by the YouTube user to gain control of the accounts.
Once hijacked, the accounts were either sold for up to $4,000 depending on the amount of subscribers, or used to livestream cryptocurrency scam videos, with the channels rebranded to pose as a major tech or cryptocurrency company.
Google, which owns YouTube, stressed that YouTube had detected and recovered 99 percent of the hijacked channels, and that it was taking further steps to heighten security against this type of hacking campaign. The FBI had also been made aware of the hacking efforts.
