Android Malware Named MasterFred Seeks User App Login Information

If you have an Android device be aware that there's a new strain of malware out there. Called MasterFred this new malware utilizes well-constructed fake login overlays in order to steal the login and credit card information for Twitter Instagram and Netflix users.

A sample of the code was submitted to VirusTotal in June of 2021 when the malware was first spotted in the wild.

Independent analyst Alberto Segura shared a second sample online a week ago with the note that the malware he sampled was used against Android users in Turkey and Poland.

Avast Threat Labs got their hands on the sample and discovered APIs provided by the built-in Android Accessibility Service were utilized to display the malicious overlays.

Avast Threat Lab had this to say about their research:

"By utilizing the Application Accessibility toolkit installed on Android by default, the attacker is able to use the application to implement the Overlay attack to trick the user into entering credit card information for fake account breaches on both Netflix and Twitter."

While not new or innovative it is a clever bit of code relying on elements native to the device under attack to help the malware accomplish its mission. That's not to say that MasterFred isn't innovative in other ways however. For instance it uses a dark web gateway called Onion.ws to deliver the login and credit card information it steals to its command and control server.

Note that briefly MasterFred was found on the Google Play store embedded in a legitimate app. That app was removed but given its presence there (however temporarily) it stands to reason that the hackers are also pushing their malware out to third party app vendor sites as well.

Stay vigilant. MasterFred certainly won't be the last threat we see this year.

Call SpartanTec, Inc. now for more details about cybersecurity and managed IT services.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

Most Bait Phishing Attacks Target Gmail Accounts

A new report by Barracuda was recently published. It revealed that the vast majority of baiting email attacks conducted this year were done via G-mail accounts.

The firm surveyed 10,500 different organizations and found that more than a third (35 percent) of them received at least one bait attack email in September 2021 alone.

That's disturbing but perhaps it would be of benefit to back up a step. The term "Bait Attack" signifies a sub-class of phishing where hackers and scammers attempt to glean basic information about a particular person or organization. They then use that information for a more targeted attack in the future.

Bait Attacks and Email Security

Essentially it's a simple cyberattack where if it is successful it will lead to a more complex attack in the future. That would be an attack that's more likely to succeed given the earlier success.

Of significance is that these emails don't contain links that point to the outside world. They don't have attachments so there's nothing in the email that would raise any red flags. These messages sail right through even the most robust security systems because they're not harmful in any way. In fact sometimes they don't contain any text in the body at all.

The goal here is to illicit a response. So if there is text it will likely be simple, clear, and to the point. It could perhaps be even as simple as "Please confirm that this is indeed your email address."

If the recipient responds the sender learns a number of important details. These details include the fact that the email account is correct and active, that the recipient is at least somewhat likely to open unsolicited emails from unknown senders, and that the company's spam filter didn't block the email that was sent. From the perspective of a hacker that's a treasure trove of information.

As to why they have a preference for Gmail over other email providers that ultimately comes down to legitimacy. Google is a respected name. Hackers can leverage that respectability by using a Gmail account and often fly under the radar.

There's nothing specific to be done with this information beyond warning your employees to stay vigilant and resist the temptation to respond to unsolicited emails from unknown senders.

Call SpartanTec, Inc. now if you need more information on how you can protect your information from phishing and other online threats.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

Cybersecurity Tips When Shopping Online

Online shopping has seen a huge increase in popularity over the past few years due to its ease-of-use and promise of next-day delivery. Online shopping isn’t just convenient for us, but it’s also good business for fraudsters and cybercriminals. Scammers will try to convince us to pay for goods that we don't need or get our personal information for their financial gain. What can you do to stop it? When shopping online, it is important to protect yourself with cybersecurity tips.

These tips will help you enjoy shopping online with confidence.

Cybersecurity Tips For Online Shopping

Don't click before you think: Avoid clicking on emails, text messages or any other promotional material that seems "off" or urges you to click on certain links. Do not click on any link that appears tempting if you are sent the email. To verify that the offer is genuine, you should go to the company's site. Report the scam to your email provider if you don't see it on their site. It is possible to fall for a scam if it appears too good to be true.

Do your research

Fraudsters love to set up fake ecommerce websites.  One way to improve your online security is to read reviews about the merchant before you make a purchase. You can also check trusted sources like the Better Business Bureau. You should also look for the physical address and contact information. To confirm the merchant's legitimacy, it is a good idea that you call them.

Take into account your payment options. A credit card is better than a debit card. Credit cards have more protections in case something goes wrong. You can also use a third-party payment service to pay for your credit card. You can pay for purchases using many different services, such as Google Pay, without having to give your credit card information.

Pay attention to what you divulge: You should be aware of the information that is being collected in order to complete your transaction. You can cancel the transaction if the merchant requests more information than you are comfortable sharing. Only fill in the required fields at checkout. You should not save payment information in your account. If your account automatically saves it, you can log in to delete any payment details.

You should keep an eye on your credit card and bank statements for. Management of your data security requires good recordkeeping. You can also set up alerts to receive email or text messages with transaction details whenever your credit card is used.

Security and safety tips

Maintain a clean computer: Make sure all internet-connected devices, including smartphones, tablets and PCs are safe from malware and other infections. Only use the most recent software and apps. This protects your device from any new vulnerabilities or threats.

Secure your login. Create long, unique passphrases and use multifactor authentication (MFA) whenever possible. MFA can strengthen your online accounts by enabling biometrics and a unique one time code sent to you via mobile or phone.

Secure Wi-Fi is recommended: While it's extremely convenient to shop online from your local coffee shop, it is not safe. Do not make any purchases over public Wi-Fi. Instead, use a Virtual Private Network or your smartphone as a hotspot. You can also save your purchases to your cart and wait until your home network is secure.

Give the gift of peace of mind

Do you want to buy an internet-connected device as a gift for your loved one? Do not assume that they are familiar with how it works. Give recipients the opportunity to learn how to set up privacy and security settings, create strong passwords, and disable any features that they don't use. Do not make it difficult for your loved ones to learn. Give them peace of mind and a device.

Call SpartanTec, Inc. now for more information on how to improve your cybersecurity.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

Related Posts

• Fake Gift Card Balance Checking Sites May Steal Your Money
• Creating Your Dream IT Team For The New Cybersecurity Era
• Staying Compliant and How Cybersecurity Solutions Can Help
• Cybersecurity Professionals In Today’s Modern Day Society
• A United States Bank Hit By Ransomware And Data Breach

Understanding Firewall Protection And What It Can Do For You

Firewall protection can help keep your computer safe from intruders like hackers whenever it is connected to the internet. It does this by checking the electronic data that comes in and out of your computer.  A good firewall offers protection from all those prying eyes. It prevents thieves as well as intruders from gaining access to your laptop, computer, server, or workstation. An excellent firewall can also offer protection to your computer against malicious worms.

Firewall Protection Against Identity Theft

A good firewall can help protect you from identity thieves. They are computer hackers who can find their way into vulnerable computers where they steal important files, tax records, credit card information, passwords, and reference or identification numbers. Remote thieves also exist and they are the ones who can hijack your computer system and send spam messages, or even plant computer viruses in your units.

What Can a Firewall Do?

To put it simply, a firewall can protect your computer from attack, scanning, or other similar types of intrusion made by hackers while they are connected to the internet. A firewall will check electronic data that comes in or out of a computer unit or a network and will compare it to the regulations that it has been provided. When the data matches the set rules, it will be allowed to pass. However, if it does not then the electronic data will be blocked. You may consider a firewall as a piece of software that can keep bad guys out of your unit or network and allow the good ones to get access.

According to research, a computer system that is not protected can be attacked in just a matter of minutes after starting to use the internet. That’s why it is very important to have a security software installed on your computer before you connect to the internet. If your computer is brand new and there is no internet security installed, it is suggested that you download and install one first along with the latest Windows updates and patches required for your computer to be secured before you start browsing the internet.

Is there anything that a firewall cannot do?

A firewall won’t give you the full security you need to make you completely safe when you are connected to the internet. It is one of the first lines of defense but it cannot protect you 100% on its own. That is why an internet security suite has other pieces of software too. A firewall cannot protect you from most viruses, spam messages, insufficiently configured Wireless Network, and installation of malware software.

SpartanTec Inc. understands that businesses rely on the internet to run their operations. With their managed firewall services, your business network and systems can be protected so you can be worry free and simply let the experts manage these things for you. Our managed firewall solutions include web content filtering, total security from online dangers, hardware & software, and simplified management.

Don’t put your business at risk. Contact SpartanTec Inc. and let our experts help you protect your business from online threats.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

The Hidden Dangers Of “Shadow IT” To Your Business

We all know that using information technology — programs, apps, or internet browsing — carries a certain amount of cybersecurity risk.

Nobody wants to have their secure data compromised, but technology brings enough benefits that the risk is worth it. So, you vet certain systems, you establish protocols, you update and patch your software, hire IT support experts, and you keep track of the technology used at work.

But what about the technology your employees are using that isn’t part of your official plan? We’re talking about messaging apps, Excel macros, cloud data storage, collaboration spaces, and even hardware like USB drives, smartphone storage, and personal laptops that you don’t control.

We call this “shadow IT,” and that’s a whole lot of potential holes to cover!

What is Shadow IT?

Even if you ignore the dangers of having accounts hacked, data stolen, and websites vandalized, shadow IT can be very inefficient. You don’t control it, so you don’t know where important information is or what work is being done. It makes it hard to avoid duplication of efforts and even harder to manage employee productivity. What are you to do? If you're not sure, seek out the help of IT support professionals.

Well, your gut reflex might be to “crack down” on using unauthorized technology for work purposes. Swallow that reaction, though — you can’t stop it, and you’ll just harm morale. You’ll also drive usage even further underground; your people won’t be honest with you for fear of reprisal. That means that if a compromise occurs, you’ll be the last to know.

Instead, keep an eye on the situation. Make it clear that you support employees using the tools they need to get the job done, as long as they let you know what those tools are. If your people start using cloud storage apps, that’s fine — but have them explain how they’ll keep that data secure. Just as you empower them to find their own tools, empower them to keep things secure.

You probably can’t come up with a list of all the shadow IT that’s being used at your work, but you can keep an eye on the trends as they develop. Research the technology that’s being used and watch the headlines for data breaches or other compromises.

In some cases, you will have to crack down on specific apps, programs, or devices being used at your work; they’re just too risky. If you’ve worked with employees and fostered good communication, this shouldn’t be an issue. Remember to avoid blaming employees when shadow IT becomes a problem — especially if they bring the issue to your attention themselves. There’s nothing wrong with asking your people to stop using a specific program or device, as long as you’re transparent and have good reasons.

Last, but not least, try to look on the bright side. Shadow IT may be a little risky, but it also presents opportunities for employees to drive productivity and try out new best practices. If they’re using a piece of technology, it’s probably doing something that the currently “approved” tech is not. They’re also showing self-starter tendencies and trying to do their job better. And that’s always something you should support!

Call SpartanTec, Inc. now and let us help you get rid of the hidden dangers of Shadow IT to your business.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

New Android Malware Wreaks Havoc For Some Users

There's a nasty new strain of malware you need to be aware of that targets Android devices. Don't let the funny name fool you because AbstractEmu is a serious threat.

Not only will it root an infected device but it will allow the controller of the malware to take total control of the device. It will alter its settings and attempt to evade detection via a combination of anti-emulation checks and code abstraction.

The new strain was discovered by cybersecurity researchers at Lookout Threat Labs. They discovered it bundled with a collection of legitimate utility apps distributed via the Google Play Store and other third-party app repositories.

Google has removed the malware from the Play Store at this point but not before several thousand people had already downloaded it. The malware remains available on a few different third-party repositories. If you're in the habit of picking up apps outside of the Play Store an extra measure of caution is prudent.

The team that discovered the new strain had this to say about it:

"AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app. As the malware is disguised as functional apps, most users will likely interact with them shortly after downloading.

By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware -- steps that would normally require user interaction."

Needless to say the group behind AbstractEmu has some skill and some serious coding chops. Although the malware strain's removal from the Google Play Store has limited the rate of its spread you can bet the threat group will be on the lookout for other opportunities.

SpartanTec, Inc. now if you want to protect your business against malware and other cybersecurity threats.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

Hackers Turn To New Trick Called SEO Poisoning

Hackers have a new tool in their toolbox you should be aware of. Called SEO Poisoning or sometimes "search poisoning" the attack relies on Black Hat SEO techniques to optimize web content.

Researchers from Menlo Security have spotted two separate campaigns one linked to the SolarMarker backdoor and the other leveraging REvil ransomware to infect unsuspecting netizins.

Here's how the attacks work:

The hackers gain access to legitimate sites that rank well on Google and inject them with a variety of specific search terms.

Because the site is respected and ranks highly on its own surfers who find their way onto the site are more likely to accept that anything on the site is legitimate. The hackers leverage this trust by adding poisoned content to the site. This poisoned content appears in search results to be a PDF file requiring a download in order to view it.

When a user clicks on a download link they seal their fate. Behind the scenes they are redirected multiple times ultimately winding up at a poisoned site controlled by the hackers where a malicious payload is dropped onto the visitor's device.

Both of these campaigns have leveraged respected WordPress sites taking advantage of an undisclosed flaw in a plugin called 'Formidable Forms.' The hackers install their malicious PDFs in the wp-content/uploads/formidable/ folder.

Most cybercriminals who deploy ransomware demand exorbitant fees to regain access to your files. These two campaigns are notable for making much smaller demands ranging between $1,500 and $7,500.

If you have a WordPress site and you use the Formidable Forms plugin download the latest version as soon as possible. The plugin's developers moved quickly to address the issue and a fix is available. As long as you are running version 5.0.10 or later you should be fine.

Call SpartanTec, Inc. now if you need help in protecting your business against various cybersecurity threats.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

New TodayZoo Phishing Campaign Is Going After Passwords

Microsoft recently reported on the existence of an unusual phishing campaign designed primarily to harvest the passwords of unsuspecting victims.

One of the things that makes the campaign so unusual is the fact that it appears to be built by using bits of code copied and pasted from the work of other hackers. Call it a "FrankenPhishing Campaign" if you will.

Microsoft borrowed from the story of The Island of Doctor Moreau and has dubbed this campaign "TodayZoo". While it may be crude and cobbled together from the work of other it has been both large and successful enough to gain attention.

The campaign does a surprisingly admirable job of impersonating Microsoft's own brand. The campaign makes use of a technique called "zero point obfuscation" which makes use of HTML text written in a font size of zero designed to evade human detection.

This tool is a simple and almost crude plan and yet it has proved to be surprisingly successful. Users get an email that appears to be from Microsoft. The body of the email indicates that the user's Microsoft 365 account has been compromised and the user's password must be reset.

The email contains a link but of course, the link only points to a dummy version of the password reset page. The moment the user enters his or her login credentials all they're doing is handing them over to the people who orchestrated the phishing campaign or the cybersecurity threat.

Note that most phishing campaigns that work this way collect the login credentials on one site then forward them onto some other. In this case, the people behind the campaign are simply storing the credentials on the site that collects them.

All of this points to a group of enthusiastic amateurs. It's an audacious campaign and they will undoubtedly learn from it and improve. Odds are excellent that this is not the last we've heard from this group.

Call SpartanTec, Inc. now if you need the help of professional experts in keeping your information safe from hackers, phishing campaigns, and other online threats.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

New TodayZoo Phishing Campaign Is Going After Passwords

Microsoft recently reported on the existence of an unusual phishing campaign designed primarily to harvest the passwords of unsuspecting victims.

One of the things that makes the campaign so unusual is the fact that it appears to be built by using bits of code copied and pasted from the work of other hackers. Call it a "FrankenPhishing Campaign" if you will.

Microsoft borrowed from the story of The Island of Doctor Moreau and has dubbed this campaign "TodayZoo". While it may be crude and cobbled together from the work of other it has been both large and successful enough to gain attention.

The campaign does a surprisingly admirable job of impersonating Microsoft's own brand. The campaign makes use of a technique called "zero point obfuscation" which makes use of HTML text written in a font size of zero designed to evade human detection.

This tool is a simple and almost crude plan and yet it has proved to be surprisingly successful. Users get an email that appears to be from Microsoft. The body of the email indicates that the user's Microsoft 365 account has been compromised and the user's password must be reset.

The email contains a link but of course, the link only points to a dummy version of the password reset page. The moment the user enters his or her login credentials all they're doing is handing them over to the people who orchestrated the phishing campaign or the cybersecurity threat.

Note that most phishing campaigns that work this way collect the login credentials on one site then forward them onto some other. In this case, the people behind the campaign are simply storing the credentials on the site that collects them.

All of this points to a group of enthusiastic amateurs. It's an audacious campaign and they will undoubtedly learn from it and improve. Odds are excellent that this is not the last we've heard from this group.

Call SpartanTec, Inc. now if you need the help of professional experts in keeping your information safe from hackers, phishing campaigns, and other online threats.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

This Mac Malware Should Have Users Worried

Researchers from Microsoft have reported the discovery of a new variant of macOS malware called WizardUpdate.

The new version should worry all Mac users because it has been upgraded to incorporate enhanced evasion and persistence tactics that will make it more difficult to track, locate and ultimately stop.

WizardUpdate is also known as UpdateAgent and it is based on code that is distributed via download repositories. That is where it masquerades as a legitimate and safe software. Although the researchers found no direct indication of how this new variant is distributed it follows that the group behind the code would use similar if not outright identical techniques.

WizardUpdate has had a short but interesting history when it comes to cybersecurity breaches. It was first discovered in November 2020. In its earliest incarnation the code could do little more than collecting and exfiltrating basic system information. That proved to be but a simple test. Since its initial release WizardUpdate has seen numerous upgrades.

The latest build includes the following capabilities:

• To grant admin permissions to regular users
• To leverage existing user profiles to execute commands
• To modify PLIST files using PlistBuddy
• To bypass Gatekeeper by removing quarantine attributes from downloaded payloads
• To grab the full download history for infected Macs by enumerating LSQuarantineDataURL String using SQLite
• And to deploy secondary payloads downloaded from cloud infrastructure

Microsoft had this to say about the newly discovered strain:

"UpdateAgent abuses public cloud infrastructure to host additional payloads and attempts to bypass Gatekeeper, which is designed to ensure that only trusted apps run on Mac devices, by removing the downloaded file's quarantine attribute."

"It also leverages existing user permissions to create folders on the affected device. It uses PlistBuddy to create and modify Plists in LaunchAgent/ LaunchDeamon for persistence."

WizardUpdate by any name is a scarily capable malware strain and Mac users should be on high alert.

Call SpartanTec, Inc. now and let our team of IT support professionals help set up the most effective cybersecurity measures to protect you from malware and other types of online threats.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

The First Line of Defense for Data Security

At the end of World War I, German engineer Arthur Scherbius constructed a device that would become central in another worldwide conflict of unimaginable magnitude over 20 years later: the Enigma machine. The machines, which steadily became more complex with each iteration, consisted of a series of rotors that, by themselves, encrypted messages input via the attached typewriter. Each rotor performed a simple substitution cipher, but when run through multiple rotors, the encryption reached a staggering level of complexity.

Initially used for transmitting sensitive company secrets in the commercial sector, the technology was eagerly adopted by the German military machine before World War II. After war broke out across Europe once again, Enigma encoding became central to the operation of the Axis powers, used for sending vital, sensitive intelligence across the airwaves. Due to the complexity of the Enigma system, the Germans were certain that the code would not, and could not, be broken.

But the Germans were wrong. Using photographs of stolen Enigma operating manuals obtained by a German spy, the Polish General Staff’s Cipher Bureau managed to construct an Enigma machine of their own, enabling them to covertly decrypt substantial amounts of Axis intercepts. Ahead of the impending invasion of Poland, the Poles shared their knowledge with the French and British military to expedite the defeat of the Germans. A massive team at Bletchley Park in Buckinghamshire, led by code-breaking master Alan Turing, became the central location for Allied efforts to keep up with Enigma operations.

Germany, still convinced the code was fundamentally unbreakable, continued using Enigma for a wide array of communications. But even the most complicated four-rotor Enigma systems were eventually decrypted. Great pains were taken to ensure the Germans never learned their precious code had been broken, labeling any intelligence gained from Enigma as “Ultra,” keeping the significance of Bletchley Park’s operations under wraps. Ultra-intelligence was used sparingly to avoid German suspicion.

The efforts of the Polish Cipher Bureau, Alan Turing, Bletchley Park, and the hundreds of men and women who contributed to the cracking of the Enigma code were described as “decisive” in the shortening of the war, and, at the high end, are estimated to have saved over 14 million lives.

Much like the Germans who assumed Enigma was uncrackable, most business owners believe their current, potentially outdated, cyber security measures will keep their data safe. But, in the contemporary age where digital information is as precious as gold, cybercriminals are working around the clock to penetrate even the most robust security solutions. You can bet they’ve already created a workaround for your current antivirus. What was good enough before may not be good enough today. After all, it’s simply impossible that a security solution like firewalls from even two years back could be equipped to defend your precious data from a cutting-edge hacking technology that didn’t even exist when it was created.

Today, companies that fail to stay abreast of the latest cybersecurity trends — clinging foolishly to their own Enigma — are certain to pay the price down the line. Once the lock is picked, you need a new lock, and criminals are cracking new locks every day.

Luckily, as your IT provider, we’re data security experts, and we constantly seek the latest and most robust security solutions. Don’t leave your company’s security up to a false sense of confidence. Always be looking at options to upgrade your digital security and backup and make it a sure thing.

 

Call SpartanTec, Inc. now if you need help in bolstering your data security to keep your business protected against various online threats.

 

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston

Criminals Are Using YouTube Video Channels To Spread Malware

YouTube has long been a hunting ground used by hackers and scammers to push all manner of hoaxes, scams and malicious code onto unsuspecting users. A security researcher known only as Frost is working for Cluster 25. Frost has reported a significant uptick in the number of malware campaigns orchestrated from YouTube.

Overwhelmingly these campaigns are pushing Trojans onto the PCs and smart devices of their victims.

Frost has identified what appear to be two clusters of malicious activity occurring simultaneously. One of these is pushing the RedLine trojan and the other is pushing Racoon Stealer.

Literally thousands of videos and channels have been made in the conduct of these two campaigns. Based on Frost's personal observation the campaigns are adding 100 new videos and 81 channels every twenty minutes.

He had the following to say about the identified campaigns:

The videos in question cover a wide range of topics. The hackers behind the campaigns tend to favor videos about software cracks, how to guides that outline how to get around software licenses, cryptocurrency, software piracy, game cheats and VPN software.

The videos are at least vaguely helpful and contain a link that the video's authors claim is to a tool that will help the viewer on his or her quest related to the topic of the video. Naturally the link is nothing of the sort and clicking on it will install malicious code on the viewer's device.

The cyberthreat has gotten serious enough that YouTube's owner Google made a formal statement about the matter.

Google's statement reads in part as follows:

"We are aware of this campaign and are currently taking action to block activity by this threat actor and flagging all links to Safe Browsing. As always, we are continuously improving our detection methods and investing in new tools and features that automatically identify and stop cybersecurity threats like this one. It is also important that users remain aware of these types of threats and take appropriate action to further protect themselves."

The moral of the story is simple: Be very careful about any links you click.

Call SpartanTec, Inc. now if you need help in protecting your business and network against malware and other online threats.

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence, Charleston