A new report from the Google Threat Analysis Group (TAG) highlights an ongoing phishing campaign against YouTube creators.

The TAG attributes the attacks to a group of hackers recruited on a Russian-speaking forum. They hack the YouTube creators' channels, offering them fake collaboration opportunities. Following the takeover, YouTube channels are either sold to the highest bidder or used to promote cryptocurrency scams.

“A large number of hijacked channels were then changed and are used for live coverage of cryptocurrency scams. In the account trading markets, the seized channels cost $ 3 to $ 4,000, depending on the number of subscribers "

- was provided by TAG.

Allegedly, YouTube accounts have been hacked with cookie-stealing malware, bogus software set up to run on the victim's computer. The TAG also said hackers also changed YouTube channels' names, profile pictures, and content to impersonate big tech companies or cryptocurrency exchanges.

According to Google, "the attackers were broadcasting live videos promising to give away cryptocurrencies in return for the initial contribution." As a countermeasure, the company invested in tools to detect and block phishing and social engineering emails, cookie theft and scam live broadcasts.

Google reportedly managed to reduce the number of phishing emails in Gmail by 99.6% as of May 2021. “Thanks to increased efforts to detect [fraud], we have noticed that attackers are switching from Gmail to other email providers (mostly email. cz, seznam. cz, post.cz and aol.com) ”the company added.

Google also shared these findings with the US Federal Bureau of Investigation (FBI) for further investigation.

Recall that hackers have been quite active in the cryptocurrency market lately. More than 3.1 million (3,117,548 to be exact) email addresses of users reportedly leaked from the CoinMarketCap website, which is used to track cryptocurrency prices.

According to Cointelegraph's article, Have I Been Pwned, an online intrusion tracking website, discovered that hacked email addresses are sold and sold online on various hacking forums.

CoinMarketCap, a subsidiary of the Binance cryptocurrency exchange, confirmed that the list of leaked user accounts was consistent with the user base:

“CoinMarketCap realized that these batches of data are a list of user accounts. While the lists of data we saw are just e-mail addresses, we found a correlation with our subscriber base. "