YouTube Info Stealer Dupes Users Looking for Cracked Software

Cybercriminals have been found targeting YouTube users with information-stealing malware to wipe their system data. Researchers at the Cyble Research & Intelligence Labs (CRIL) found a phishing campaign that starts with links in YouTube video tutorials that offer free versions of otherwise paid software. The YouTube info stealer was found camouflaged in over a hundred legitimate apps and games and installing them led to a data breach. The data was sent to the hacker’s command and control (C&C) server.

Users who were looking for cracked software, keygens to open software illegally, plugins, Roblox scripts, and cheats on a search engine such as Google were directed to YouTube. There they would find video tutorials with fake links to game hacks or cheats clicking which the info stealer would start working in the background. Researchers noted that the stealer log or the stolen data could be manipulated in multiple ways causing harm to the user such as selling on cybercrime marketplaces, furthering their access using connected accounts, targeting connected corporate networks, etc.

The hackers largely used the Vidar and RecordBreaker stealer, which is known to copy bank data, saved passwords, IP addresses, browser history, login data, crypto wallets, etc. CRIL researcher found that one of the videos had over 18,000 views which pointed towards the number of users that might have used the links and been duped. The cybercriminal managed to post comments under the videos to convince the users of its legitimacy.

Details of the YouTube info stealer campaign

The hackers used well-known names of websites, scripts, cheats, and plugins to lure users. A cheat was found for downloading Kiddions modest menu and the plugins included Sapphire and Twixtor. The binaries used were mostly in the form of droppers or downloaders for the payloads.

The websites that were used to host the malicious YouTube videos were:

• hxxps://teensoft[.]org/
• hxxps://wh1tesoftware[.]me/
• hxxps://soft-exp[.]org/
• hxxps://appshigha[.]com/

Names of the legitimate websites used included:

1. MS Office
2. Spotify premium 2022
3. Adobe software
4. CCleaner PRO
5. AutoCAD

A list of some of the software the presently unknown cybercriminals used to pose as legitimate users were:

1. DaVinci resolve
2. FL studio
3. Lumion 12 pro
4. Voicemod pro
5. iCloud bypass iOS 15

Some of the gaming software names that the hackers used were:

1. Marvel’s spider man
2. Wanderer download
3. Far cry 6
4. Elden ring
5. Rust hack
6. GTA online mod menu
7. Valorant hack
8. Warzone hack

Roblox scripts that were used included:

1. Prison life
2. Arch piece
3. Tatakai V.2
4. Telekinesis
5. Viet nam piece
6. Apocalypse rising 2
7. Raise a floppa