Russian crooks are stealing YouTube accounts — what to do

A content creator with camera, microphone and laptop accessing YouTube on a smartphone.

(Pictur credit: Sutipond Somnam/Shutterstock)

Google has busted a Russian gang that was sacred to swindling YouTube calm creators knocked out of their accounts.

The work party's tactic was to befriend successful YouTube "creators" or "YouTubers" — those YouTube uploaders of original placid such as PewDiePie who have enough followers to earn a lot of money through ads, merchandising and affiliate golf links — and propose partnerships or other types of fiscal or promotional agreements.

Valiant just ditched Google for its own privacy-centered search locomotive
The best password managers to protect your online accounts
Plus: Netflix canceled shows in 2021 — these shows are ending

According to a post yesterday (Oct. 20) by Google Threat Analysis Group's Ashley Shen, the gang would so send poisoned files to the creators to steal passwords and session cookies, enabling the crooks to absorb the creators' accounts.

"The actors behind this campaign, which we property to a group of hackers recruited in a Communicative forum," Shen wrote, "lure their target with fake collaboration opportunities (typically a demo for antivirus software, VPN, music players, photo redaction or online games), commandeer their communication channel, then either sell it to the highest bidder or use information technology to circularise cryptocurrency scams."

The stolen accounts, Shen said, could be resold for upwards to $4,000 each.

How to protect your YouTube account

To protect your YouTube and another social-media accounts from hackers and hijackers, Google recommends:

Paying attention when your web browser warns you that a website power not be safe to approach
Scanning all downloaded files with some of the best antivirus software before possible action them
Turning on Enhanced Rubber Browse Protection in your Chrome security measur settings
Using two-factor hallmark (2FA) to protect your accounts from hackers who mightiness have your passwords

Tom's Guide would also recommend using peerless of the second-best password managers as recovered, because storing passwords in a browser makes them ripe targets for info-stealing malware.

Shen provided an exemplar of an email subject matter sent to a YouTube creator proposing to earnings the YouTuber to promote a brand of antivirus software. The message aforementioned the YouTuber would motivation to install and prove the antivirus software on video.

If the YouTuber agreed, the crooks would and so send the creator an instant message, email message, PDF OR written document with links to a website where the creator could download the software.

Shen said many than 1,000 malicious websites and social-media accounts were created for this aim, many of which mimicked legitimate brands such atomic number 3 Cisco or Steam.

Merely the software system the YouTuber would download and put in contained malware that stole passwords and school term cookies, those tiny bits of data that keep you logged into online accounts for long periods of time. Prickly with those taken items, the crooks could lead over the YouTube accounts.

The masterminds down this outline used Russian-oral communicatio online forums to recruit lower-level crooks to do the dirty work, likely between 25% and 70% of the revenue from the hijacked channel depending on the amount of evil deeds they'd be voluntary to do.

Shen said that beginning Nov. 1, YouTube content creators whose channels earn money will call for to receive 2FA enabled on their Google accounts to access dependable YouTube tools.

More: Hera's all the ways Google Pel 6 boosts your security and seclusion

Paul Wagenseil is a precedential editor at Tom's Maneuver focused along security system and privacy. Atomic number 2 has also been a dishwasher, fry cook, semipermanent-haul device driver, code scallywag and video editor in chief. He's been rooting around in the selective information-security space for Sir Thomas More than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has conferred talks at the ShmooCon, DerbyCon and BSides Las Vegas drudge conferences, shown heavenward in unselected Goggle bo news floater and even moderated a jury discussion at the CEDIA place-applied science conference. You can follow his rants connected Twitter at @snd_wagenseil.