Hot off the presses, there is yet another scam going around targeting YouTubers to hijack their
channels. Team YouTube on Twitter made a tweet warning about this, and it's actually pretty
clever because it uses a feature of YouTube that is lesser-known. How the scam starts is you get
an email that says, "YouTube Team Sent You a Video - Changes in YouTube Rules and Policies."
But the thing is, it comes from the actual no-reply@YouTube.com email address. It's not
spoofed. The domain is actually Youtube.com, which is really tricky. So at a quick glance,
without really thinking about what this email actually is,
you might think it's an official announcement from YouTube. But how it actually works is it
uses a feature that lets you send an email invite to view a private video.
So you can see you type in whatever email addresses you want,
and it'll send that email to them with the name of the video and the description,
which of course has all that scam stuff in it designed to look like an announcement.
Though when I tested it, it looks like YouTube might have recently made a change
to this because now the subject line, for me at least, says a private video was shared with you.
It doesn't say "whatever channel name shared this video" and all that. So it
looks like YouTube might've made that change slightly, which I think will improve things,
but still might trick some people. This is very reminiscent of another scam for PayPal,
which involves using the invoice feature of PayPal, where you can generate an invoice
and just send it to anyone you want and make it look like an official bill that you have to pay.
And it actually does come from the real PayPal domain,
but it's just some random one someone sent you. You don't have to pay. And this
is the same thing here. It's just a random video. They named the channel YouTube Team,
and the title of the video is "Changes in YouTube Rules and Policies. Check the description."
And then the description tells you that you need to accept new monetization terms and that you
need to download a document for the agreement and that it's password protected to keep it private,
I guess. In reality, they just put a password on the zip file so that
antiviruses can't scan into it. And I love how the [Google Drive] link that
they give you actually has a "no antivirus" parameter in there, just a cherry on top.
And I should point out that this might actually be more realistic than you think,
because in the past year, YouTube has implemented some monetization changes
and you do have to agree to a new thing. So some people, if they don't look closely,
might think that this is what they have to do. I'll go over more about the file
it downloads in a minute, but the video that they send you is actually pretty interesting.
Another YouTuber, "Enderman", made a video where he got one of these emails and showed
the video that they linked to. And it was literally a deepfake of the CEO of Google,
basically stating the same stuff as in the description. I personally can't even view
the video because like I said, it's actually private, not just unlisted.
And I've not gotten one of these emails inviting me to view one of them. So
definitely check out his video where he shows this and includes the voice.
I don't want to post it here and steal all his thunder, but I'll have it pop out. Basically
though, it uses one of the newer text-to-speech services, which actually sound kind of realistic,
except the transcript for what they have the thing reading doesn't really sound realistic.
But the thing is that it actually does kind of sync up with the mouth movements in the video.
Not exactly, if you look closely it doesn't sync up perfectly. But if you're not looking closely,
it might be enough to fool some people. There are definitely ways they could
make it look way more realistic, but I'm going to refrain from saying them here.
I don't want to give them any ideas. Anyway, after you download the file,
it's the same playbook as the other YouTube channel hijacking scams. Where the file is
a virus, and when you run it, it steals the cookies of your browser sessions. And then
it's used to stream a crypto scam. I made a video about this before with more details,
but you can see in this case, it's actually a screensaver file disguised as a PDF.
Screensaver files actually can run like executables, and apparently you can change
the icon of them. So unless you have file extensions enabled or inspected in other ways,
you wouldn't know. And they use the other tactic of making the file huge so that it's too big to
upload to VirusTotal or other sites, and it might even slow down local antiviruses from scanning.
And like I talked about in my other video, another file type they use is ".com" file,
which is another type of executable. And they use that to mimic Youtube.com in the file name,
but really that's the file extension. So clever stuff. You really have to be on guard with this
kind of stuff, even if you're not a YouTuber, this is something that could happen to really anyone.
So yeah, not much more to say about this. It's just a new twist on an existing scam.
And I thought this one was especially worth talking about because it uses a real domain,
Youtube.com, and it's got the deepfake. You know, a lot of variety here. So if
you did enjoy this video, definitely give it a thumbs up for the YouTube algorithm.
And if you want to keep watching, I'll put links to that video I made talking about
how YouTubers are getting hacked if you want more details. And if you want to subscribe,
I try to make videos about twice a week,
usually Wednesday and Saturday. So hope to see you in the next one. Thanks for watching.