Hello, World! Hackers targeting YouTubers and turning their channels into Elon Musk
crypto scams is a bit of a problem - and if you don’t believe me, just ask Linus. But I may have
uncovered a case of cyber criminals actually trying to pay YouTubers to spread malware.
It all started when I received a DM on Twitter from one ‘Lisa Burgess’,
the “Advertising and digital media manager at FoxyDefender”, “We’re excited about advertising
on your channel and discussing a potential partnership with you.” Essentially they
want me to promote their anti malware software FoxyDefender. Now, most sponsorship requests I
get just go straight into the bin, for the simple reason that they want me to promote something
that’s completely irrelevant to my content, like the time I got an email from a company wanting
me to sell you guys their portable bathtub. But anti malware software is pretty relevant
to my content, so I gave these guys a second look. At a brief glance their website looks kinda legit,
so I googled them, but other than their website itself I couldn’t find anything, there is an old
Android game with the same name ‘FoxyDefender’, but other than that, nothing - there’s no reviews
of their software, nothing. So I decided to run a simple whois check on their domain,
and it was registered merely days before Lisa DM’d me. So yea, this is rather sus - it’s
almost as if the site had just been created to target YouTubers through fake sponsorship
offers - though Lisa didn’t send me any malware - she didn’t try to hack me in any way. So,
I was curious what would come next, so I told Lisa I was interested, and asked for more information.
Whilst I was waiting for her response I did some digging, and found that FoxyDefender has quite
a few “Advertising and Digital Media Managers”, everyone’s a manager it seems. All these Twitter
profiles are obviously sock puppets accounts - sock puppet simply referring to an account
made around a fake identity that’s controlled by someone else. Some clear evidence that these
people just aren’t real is firstly, there’s no tweets from these guys, only retweets. And up
until recently those retweets were seemingly completely random, until the point at which
these accounts were presumably bought by the bad guys specifically for this campaign, and suddenly
they’re really interested in cyber security. The reason cyber criminals will often buy sock puppet
accounts off some dark web forum, rather than make their own - is because these profiles go
back over a decade, they have a few followers and some post history, so they have way more
credibility than just some newly created account. As for the profile pictures, these are obviously
AI created, the reflections in these sunglasses just don’t match, and I’m no fashion guru,
but what are those earrings. However, at this point Lisa got back to me, and told me the details
of the ad they wanted, and proceeded to ask me a bunch of questions about how often I post,
whether I have a waiting list and how much I wanted to be paid. This really caught me off
guard, because typically operations targeting YouTubers aren’t very sophisticated at all.
For example ‘Linus Tech Tips’ was hacked after an employee received a phishing email that looked
something like this - an offer to sponsor one of their videos. But with a download link for
a zip file containing the contract. After extracting the zip, what looked like a pdf
was really an executable in disguise, which contained - you guessed it, malware. This is
usually how YouTubers are hacked because it’s very low effort on the part of the cyber criminals,
they just scoop up as many emails as possible from channel about pages and send their phishing emails
en masse. Then they just sit back and wait, and don’t really have to do anything else.
But here, they’re really engaging with me in the way a normal sponsor would. But then,
after answering their questions, they asked for an email address to send the
contract to. I figured this was my Linus moment, they were simply going to send me
a spicy PDF and that would be the end of it. But no, I received a completely clean email,
sent using Adobe’s digital signature service, which took me to a legit contract. Of course,
this is just copy pasted from some template - but then again that goes for pretty much
most contracts - however, the only thing that didn’t look completely generic here,
was the mailing address of the company. After doing some googling, I found this was the
same address as the company behind malwarefox.com - a completely legit company selling real anti
malware software. And if something looks familiar here, well that’s because the bad guys have pretty
much cloned their site and replaced all mentions of malwarefox with foxydefender.
Both sites have a big red download button… on the legit site that’s for their anti malware software,
but on the fake site, it’s the opposite, actual malware. In particular, this seems
to be a variant of malware known as “VIDAR Stealer” - it’s a nasty infostealer trojan,
designed to scoop up everything from cryptocurrency wallets to saved passwords,
credit card details and ‘session tokens’, my YouTube session token of course,
is the exact thing they’d need to take over this channel and repurpose it for crypto scamming.
But, was that the actual plan? I mean - our good friend Lisa wasn’t pressuring me to download their
malware at all, maybe they just assumed that in making the ad for them I would’ve downloaded it
and run it. Or perhaps they never planned to infect me, and instead intended on sending
me some kind of legit software to make the ad about - so I’d never know about the malware being
spread on foxydefender.com - the website I’d be sending you guys to in a theoretical sponsor spot.
I mean - cyber miscreants spending money on legitimate forms of marketing isn’t new.
In a recent video we saw how bad guys were buying google search advertising on search
terms for popular software, in one case - gimp, so when someone searched for gimp,
they’d likely end up on a malicious clone of the site and unknowingly download malware.
Coincidentally in that case, the exact same kind of malware was used “VIDAR Stealer”.
I reached out to the legit malwarefox people to let them know what was going on, and as you can
imagine, they weren’t too happy. Literally minutes after receiving their response Lisa’s twitter
account was suspended and the foxydefender site was marked as malicious by all major
browsers - so I can only presume these guys must have some kind of a hotline to Google and Twitter.
Which is great, but thanks to that we’ll never know what Lisa’s grand plan was,
whether I was the target, or if they wanted me to unironically promote their malware laden website.
You might think it seems obvious that they just wanted to take over this channel and repurpose
it for a standard Elon Musk crypto scam. But I’m not so sure, the Linus tech tips hack only made
the scammers behind it around $15,000 dollars, which don’t get me wrong, it’s a nice chunk of
money - but that’s an embarrassingly low payoff for hacking one of the biggest names in tech,
and so these guys can’t be making much money at all from hacking much smaller YouTubers.
I reckon there’d be way more potential in tricking a YouTuber into making a
genuine ad promoting malware, and I was curious to see if that was the plan,
so I reached out to the bad guys behind this operation on the off chance they would agree
to an interview, but I never heard back. Let me know in the comments what you make
of all this. And I’ll see you in the next video, have a good one.