YouTube channels hacked and rebranded for live-streaming crypto scams

Google’s Threat Analysis Group (TAG) attributes the attacks to a group of hackers recruited in a Russian-speaking forum, who sell the hacked YouTube channels to the highest bidder.

A new report shared by Google’s Threat Analysis Group (TAG) highlights an ongoing phishing campaign against YouTube creators, typically resulting in the compromise and sale of channels for broadcasting cryptocurrency scams.

The TAG attributes the attacks to a group of hackers recruited in a Russian-speaking forum, who hack the creator’s channel by offering fake collaboration opportunities. Once hijacked, the YouTube channels are either sold to the highest bidder or used to broadcast cryptocurrency scams:

“A large number of hijacked channels were rebranded for cryptocurrency scam live-streaming. On account-trading markets, hijacked channels ranged from $3 USD to $4,000 USD depending on the number of subscribers.”

The YouTube accounts are reportedly being hacked using cookie theft malware, a fake software configured to run on a victim’s computer without being detected. TAG also reported that the hackers also changed the names, profile pictures and content of the YouTube channels to impersonate large tech or cryptocurrency exchange firms.

According to Google, “the attacker live-streamed videos promising cryptocurrency giveaways in exchange for an initial contribution.” The company has invested in tools to detect and block phishing and social engineering emails, cookie theft hijacking and crypto-scam live streams as a countermeasure.

Given the ongoing efforts, Google has managed to decrease the volume of Gmail phishing emails by 99.6% since May 2021. “With increased detection efforts, we’ve observed attackers shifting away from Gmail to other email providers (mostly email.cz, seznam.cz, post.cz and aol.com),” the company added.

Google has shared the above findings with the Federal Bureau of Investigation (FBI) of the United States for further investigation.

Over 3.1 million (3,117,548) user email addresses were reportedly leaked from a crypto price-tracking website, CoinMarketCap.

According to a Cointelegraph report, Have I Been Pwned, a website dedicated to tracking online hacks found the hacked email addresses being traded and sold online on various hacking forums.

CoinMarketCap acknowledged the correlation of the leaked data with their userbase but maintains that no evidence of a hack has been found on their internal servers:

"As no passwords are included in the data we have seen, we believe that it is most likely sourced from another platform where users may have reused passwords across multiple sites."

CoinMarketCap hack reportedly leaks 3.1 million user email addresses

Coin Telegraph

3.1 million email addresses linked to CoinMarketCap accounts were reportedly being traded on hacking forums, according to Have I Been Pwned.

CoinMarketCap, a price-tracking website for cryptocurrencies, has reportedly fallen victim to a hack that leaked 3.1 million user email addresses.

The information came into light after the hacked email addresses were found to be traded and sold online on various hacking forums, and revealed by Have I Been Pwned, a website dedicated to tracking hacks and compromised online accounts.

CoinMarketCap, a subsidiary of Binance cryptocurrency exchange, confirmed that the list of leaked user accounts matched its userbase:

“CoinMarketCap has become aware that batches of data have shown up online purporting to be a list of user accounts. While the data lists we have seen are only email addresses, we have found a correlation with our subscriber base.”

While confirming the leak of 3.1 million (3,117,548) user email addresses on Oct. 12, the company has assured that the hackers did not gain access to any of the account passwords. “We have not found any evidence of a data leak from our own servers — we are actively investigating this issue and will update our subscribers as soon as we have any new information,” CoinMarketCap spokesperson said.

Despite the confirmation, CoinMarketCap is yet to identify the exact cause of the hack.

CoinMarkatCap did not immediately respond to Cointelegraph’s request for comment.

A recent hack on the Coinbase crypto exchange resulted in the compromise of 6,000 user accounts.

The attack was a result of exploiting the exchange’s multi-factor authentication (MFA) system, which suggests that the hackers had access to the user’s email addresses. According to Coinbase, the attackers identified a vulnerability in the account recovery process:

“In this incident, for customers who use SMS texts for two-factor authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account.”

While the value of stolen assets is yet to be revealed by Coinbase, the incident was complimented by thousands of formal complaints from the account holders against the company.

Email