By now, many of you have probably seen or heard about YouTube channels getting
hacked and used to promote scam crypto live streams usually featuring Elon Musk
and some kind of free giveaway of crypto. But the methods these
hackers are using to take over YouTube accounts can affect anyone, even you.
And the scariest thing about this type of attack is it completely bypasses two-factor
authentication. So in this video, I'll go over how this is happening to creators as
well as stuff you yourself can look out for. You don't have to be a creator. And of course,
I'll do some ranting here and there about YouTube and Google.
So let's work backwards and start with the end result, which is a live stream,
which is a scam, usually featuring some kind of famous crypto person or Elon Musk
or Tesla. And it's usually involving some kind of free giveaway where you can get free money,
of course. But it turns out that the channels these live streams
are happening on are hijacked legitimate channels, and they were just taken over.
You might wonder how often this really happens,
but just when I was researching this video, I found 10 different channels that were hijacked
and currently streaming at the same time. So this happens kind of frequently. The
largest channel I found was over 4 million subscribers. It was like a toy channel.
There was two others that were over a million subscribers, two more that were over 500,000
and several others. I mean at this point, I don't know how YouTube doesn't have someone
whose job is to just search "Tesla live stream" and find all the hacked channels.
That's basically all I did. And when I say the hackers take over the channel, I really mean it.
They change the profile picture, the channel name, even the new @ handle, which ends up
changing the URL too. And also they private all the videos that they previously uploaded,
so there's nothing left even indicating what the channel used to be. The only way I know is to
get the actual channel ID of the account, which is unique to every channel and doesn't change.
And to do that, if you go to the video that's streaming, you can view the page
source code and then search "channelid". Then you just look for the channel ID,
which begins with UC and is 24 characters long, and then you can just copy it out.
Then you can just Google the channel ID and it might come up with the old name.
Maybe it hasn't cached in Google yet, or maybe another website will mention it. Anyway,
when the scammer starts this live stream, they'll usually try and
make it legit by botting thousands of views literally, and also buying a bunch of likes,
so thousands of those as well, hoping it'll look legit to anyone who happens to see it.
And I guess they're hoping that because the channel has a lot of subscribers,
maybe YouTube will recommend the video not just to subscribers, but also other people
who don't know that most of the views are fake, but they'll fall for it. And a clever
thing they do to prevent anyone from being able to call out the scam in the comments,
they set the live chat to subscriber only mode and only for those subscribed for 15 plus years, which
for a channel like this, which was only started in 2019, literally means that no one can comment.
And for most channels, it means effectively no one is able to comment. Anyway,
for the actual scam, they'll put in a pinned comment and probably on the screen as well,
a URL that actually takes you to a pretty legit looking website, though spoiler alert,
it can be blocked by the sponsor of the video Guardio, which I'll get to in a second.
But anyway it basically says, "Hey, if you send this amount of Bitcoin,
you'll double your money. We'll send twice back." And I mean, this is one of the oldest tricks in
the book. I remember this was going on even in RuneScape in 2005, there were people doubling
gold that they would just steal it. I mean, how people are still falling for this, I have no idea.
All right now before we continue, I have a very relevant sponsor for you today,
Guardio. Guardio is a browser extension that provides real-time protection from all sorts
of threats while browsing the web, including many of the exact things I'm talking about
in this video. For example, it blocks malicious sites using in-house custom developed methods for
detecting phishing and malware content, all before those threats even have a chance to do any harm.
And that includes protection from the recent trend of hackers using
Google Ads to distribute malware from sites impersonating popular programs like OBS,
which is actually one of the ways some YouTubers are getting hacked.
So Guardio has also added download protection to block malicious files,
even if you accidentally click to download them, even for other stuff like infected game mods, too.
Oh, and as for those scam links posted by those fake crypto streams, yep Guardio can
block those as well. And Guardio actually wrote research articles about these attacks,
which are nicknamed StreamJacking and MasquerAds. I'll link them in the description if you want
to read them. One of my other personal favorite features is it will warn you
if a website's domain has only very recently been registered, which is a major red flag.
So if a sketchy site is so new that no one has checked it yet, that tips me off that the site
should almost definitely not be trusted. Now, Guardio also scans your other browser
extensions and alerts you if there are any disguised malicious extensions installed.
And if any sites trick you into enabling shady spam notifications, Guardio will
trace the actual source of those notifications and eliminate them, even if they're disguised.
Plus, there are other features such as newly enhanced identity monitoring for leaks of your
info on the dark web, with real-time alerts even if you signed up for something on mobile. You can
scan your browser for threats for free by visiting Guard.io/ThioJoe, installing the extension,
and you'll also get a free seven-day trial to the premium features such as real-time threat removal.
So if you want a clean and secure browsing experience, again, visit Guard.io/ThioJoe,
link in the description, and also check out their affordable premium plan for full protection. And
with all that being said, let's continue. But here's where Google and YouTube really have
to take some blame, because like I mentioned, the hacker is able to not just get into your account,
but also effectively completely take over it and lock you out.
And yes, that's even if you have two-factor authentication, because this type of attack
uses cookie stealing or session hijacking, it's called. Basically what happens is the YouTuber
gets infected by malware, and I'll explain how that happens later, it's a whole thing,
and then the malware will go and find the cookie in your browser, which has the logged in session.
After you log in, your browser makes a cookie
to keep you logged in. So the virus steals that cookie, sends it to the hacker,
and then the hacker is already logged into your account. So it's not even like they have to get
past two-factor authentication or get your login. They don't have to log in at all.
They're already logged in. But the worst part in many cases is that the hacker, once they're in,
they're able to change the password and even change the two-factor authentication methods,
removing yours, adding theirs, locking you out completely. Now, if you're like me,
you're probably thinking, wait a minute, wouldn't it make sense if someone's trying to
go and change their password or change their two-factor authentication settings that it
should require you to enter your password or authenticate with the second factor?
I would have thought so too, but apparently not. For some reason, Google only requires this some of
the time, not every time. And I really don't get this because even as far back in 2021, Google made
a blog post about this type of attack and how as a result, they implemented more security checks and
added re-authentication requirements for sensitive actions, such as changing a password.
But I guess they didn't have it happen all the time, which to me seems like
the whole point. And I've tested this myself and noticed even in the past,
sometimes if I went to add a security key, sometimes it would ask me to enter the password,
other times it wouldn't, and I don't know what the difference is.
Anyway rant over, at least for now. Next, let me talk about the malware that does all this,
because again, it can affect anyone, not just creators. And then finally,
we can talk about how scammers and hackers can trick you into running this malware.
Like I mentioned, the malware is specifically designed to target browsers and session cookies,
and I believe it also even goes after cryptocurrency wallets and that sort of thing.
But in this case, the cookies are the target. In most cases, the type of malware that's used
is called Redline Stealer. And Google has been aware of this type of attack even back since 2021,
they knew creators were being targeted by it. And it also talked about how this
malware has several tricks up its sleeve to try and avoid detection.
So for example, it usually is going to have a very large file size filled with just junk
data to prevent you from uploading it to certain virus detecting websites like VirusTotal, and it
will also slow down or block local antiviruses from scanning it, just from being too big. Also,
a lot of this malware doesn't have the entire virus payload in it right away.
It basically goes and downloads it after you run it. So it can sort of get around
antiviruses because it's not going to have as much to detect. And some of them might
use anti-sandboxing properties, such as having a fake pop-up come up that needs
to be clicked by the user. And the idea for this is it will stop the program from being
run automatically in a virtual machine, which a lot of automated malware analysis tools do
because it won't know to click the thing, and then it might block it from being analyzed.
So it's a pretty sophisticated and clever virus, not going to lie. So now let's go
over how the virus gets onto the victim's computer in the first place. And one of
the techniques is targeted specifically for creators, and one of them not. The
one that targets YouTubers is usually a fake sponsorship of some kind, where they'll reach
out with probably a legitimately looking offer, and then after you interact a bit,
they'll send you maybe a media kit or some kind of documents that you're supposed to open or run.
Like maybe it's a game that you're supposed to install,
something like that. But of course, it ends up being the virus. One example I saw that
I have to admit was extremely clever is they used a ".com" executable file,
which is basically the same as an.exe, but people aren't as familiar with the .com file.
And they basically made the file name something like "contract for youtube.com."
So it was making it seem like the file name was just referencing youtube.com,
but really that was the actual file extension that was signaling it's a program,
not a document. I have been contacted by this type of scam before, but not recently.
The first one I ever got was back in 2021, September, about a month before that blog
post that Google made. And it was pretending to be a company called BandLab and their software,
and they used an email called business at bandlab dot dev. Don't go to this, by the way, it might
not be active anymore. And having never seen this before, I did find it kind of suspicious though.
The .dev domain extension, I didn't really see that very often. And I looked at the
registration date of the domain, and it had just been registered like within a day,
which obviously is an extreme red flag. So I contacted the company and said, "Hey,
I got this email, I think it's probably a scam." And they emailed me back and said, "Yeah, it is.
Thanks for telling us." And obviously I was on high alert after that. And I did get a few more
that I noticed. One was from Canon. Actually, there was a couple from Canon. For example,
it was like media at promo canon.com or promo canon dotshop. I even got one from
Neiman Marcus. It's like a retailer, high-end retailer, from neiman marcus shop dot online.
I mean all fake domains. And again, don't go to any of these. And I actually never even
responded to any of these emails. So even though I knew it was some kind of scam,
I didn't know what the game was until I read about it later. Now,
the next method the scammers use targets basically anyone, and that's with fake download sites.
Recently, there's been a ton of talk about how even Google ads are being overrun by scammers
who are advertising fake downloads to free software. So when people search for them,
a fake domain will come up and it'll actually download a virus. Sometimes this is indirectly
targeting creators with software like OBS, that is like a streaming software.
A lot of creators use that, but not just them. And it's all sorts of software that any usual person
will use. And the sites are usually pretty good copies, they look pretty legit. And this is so
common now that I am super skeptical and careful if I'm searching to download anything these days.
Though like I mentioned before, this is something that Guardio, the sponsor of the video, can block.
And I will scrutinize the URL. And the funny thing is a lot of small software
projects have kind of sketchy looking URLs for the main site anyway. So what I'll
often do is literally Google the name of the software, and on Reddit, and see if I can find
multiple people mentioning where to download it and make sure that that's the actual site.
Because I don't even trust something like Wikipedia. I could totally see someone
editing it to change it to the scam URL right before they start running a scam campaign.
I'm sure it's happened. So obviously in that case, the due diligence is making
sure the website is legit, because you're going to run whatever you download anyway.
But let me give you some tips on how to handle a file that someone might send you. I would
first check the file type and make sure that it makes sense. But don't just rely
on the file extension for that, because I just made a video talking about a virus
technique where there's a special Unicode character that can reverse text direction.
And that can be used to literally spoof the file extension, even if you have viewing file
extensions on. So you can't even trust that. What you can do is in Windows File Explorer,
usually by default, it should have a type,
file type column. And there it'll say something like application or PDF document or whatever.
You can also right click it and go to properties. It'll tell you what type of file it is. But again,
make sure here you don't accidentally double click and run it. If there's a
file that's supposed to be a document and it's actually an executable or application,
obviously it's a complete scam virus. But if it's something unusual,
like a screensaver file or a script, don't run that because that can be malicious too.
And if you don't recognize the file extension or file type at all, again,
do not run it because there are a ton of file extensions that are not very common, but can
be exploited. Finally if you can of course, scan it with an antivirus or upload it to VirusTotal,
which will scan it with a whole bunch of antiviruses if the file is small enough.
But realize even scanning it with antivirus is not a guarantee. These hackers are smart.
They use ways to obfuscate and hide what the program is actually doing. So if it's a brand new
strain of the virus, might not hit positive at all. So really you're
going to have to rely on the best antivirus of all, which is "Being Skeptical As Heck 2023."
So really a heavy dose of skepticism is the best defense. Finally, I want to do a quick rant about
YouTube. When I found all those hacked channels, I kind of wanted to do something about it, and maybe
tell YouTube so they could get working on fixing it. So at first I tweeted @TeamYouTube on Twitter.
They didn't respond, I get it, they get a lot of messages. Then I decided to go
with the creator support chat, which I have access to. Most creators do,
I think. And told the person there, I'm like, "Hey, here's a list of hacked channels. Can you
forward it to whatever team deals with this?" And credit to the guy, he did actually try,
but apparently his hands were tied and he was not able to even report it.
I think he used the hijacked channel form, but that has to be done by the channel owner.
Someone else can't do it for them. And that's really the only option he could even try,
the same as us. So I was shocked that YouTube does not have some kind of reporting system
for compromised channels, even something internal where an employee can report it.
And it's not just like fake reports from outside. That way in such an
obvious case with a crypto scam going on, they could at least lock out the
channel from everybody just until they can figure out what's going on and the
original owner can maybe realize this even happened or have time to reach out.
Because right now those scams are allowed to just ride until the video gets taken down or the whole
channel. And that can be hours sometimes. But if there was some kind of system and scammers
knew that there was a pretty good chance of a channel's stream just being immediately
shut down soon after it started, then it would make those stolen accounts a lot less valuable.
There would literally be less time for them to get victims. Because the way I see it,
the only way you're going to get rid of a scam once and for all is always
to make it simply not worth the scammers time to do. You can't reason with them,
you kind of have to take the capitalist approach and make them not want to do it themselves.
Otherwise, they're not going to stop. So anyway, hopefully you found this video helpful. Let me
know if you've come across this scam. Maybe one of your favorite channels got hacked,
or maybe you've come across one of these fake download sites and maybe
almost fell for it or did. Thanks again to Guardio for sponsoring this video.
Again, visit Guard.io/ThioJoe and install the extension to scan your browser for
threats for free. That link is also in the description. If you enjoyed this video,
definitely give it a big thumbs up for the YouTube algorithm. And if you want to subscribe,
I make a couple videos a week, usually Wednesday and Saturday, so it should be worth it.
If you want to keep watching, the next video I'd recommend is that one I mentioned before
about spoofing file extensions with that special Unicode character. I was
shocked when I found out about this because I probably would have fell for it. So I'll put
that link right there. So thanks so much for watching, and I'll see you in the next one.