Wednesday , February 19 2025

Hackers Using YouTube as a Malware Distribution Platform Via Hacked YT Channel

Morphisec Threat Labs researchers have recently exposed a sneaky loader called “in2al5d p3in4er” (Invalid Printer) that delivers Aurora information stealer malware through YouTube videos.

Using an advanced anti-VM technique, the in2al5d p3in4er loader, built with Embarcadero RAD Studio, specifically targets endpoint workstations.

Late in 2022, Aurora appeared on the threat landscape for the first time, and it’s an information stealer written in Go programming language.

150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

Indian government and educational websites, along with reputable financial brands, have experienced SEO poisoning, causing user traffic to be redirected...
Read More
150 Gov.t Portal affected  Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

The Cyber Threat Intelligence Unit of BGD e-GOV CIRT has found 600 vulnerable PRTG instances in Bangladesh, affected by the...
Read More
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru

Amazon Web Services (AWS) has been named in an FIR after a builder claimed damages to the tune of Rs...
Read More
Builder claims Rs 150 cr for data loss;  AWS faces FIR In Bengaluru

CISA Warns Active Exploitation of Apple iOS Security Flaw

CISA has issued an urgent warning about a critical zero-day vulnerability in Apple iOS and iPadOS, known as CVE-2025-24200, which...
Read More
CISA Warns Active Exploitation of Apple iOS Security Flaw

Massive IoT Data Breach Exposes 2.7 Billion Records

A major IoT data breach has exposed 2.7 billion records, including Wi-Fi network names, passwords, IP addresses, and device IDs....
Read More
Massive IoT Data Breach Exposes 2.7 Billion Records

SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

A serious authentication bypass vulnerability in SonicWall firewalls, called CVE-2024-53704, is currently being exploited, according to cybersecurity firms. The increase...
Read More
SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

AMD has released security patches for two high-severity vulnerabilities in its System Management Mode (SMM). If exploited, these could let...
Read More
AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

Lazarus Group Unleashes New Malware Against Developers Worldwide

Lazarus Group has initiated a complex global campaign aimed at software developers and cryptocurrency users. Operation Marstech Mayhem uses the...
Read More
Lazarus Group Unleashes New Malware Against Developers Worldwide

Daily Security Update Dated : 15.02.2025

Every day a lot of cyberattack happen around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
Daily Security Update Dated : 15.02.2025

Salt Typhoon to target Bangladeshi Universities, One identified

RedMike (Salt Typhoon) targeted university devices in Bangladesh, likely to access research in telecommunications, engineering, and technology, especially from institutions...
Read More
Salt Typhoon to target Bangladeshi Universities, One identified

Abusing YouTube as a Distribution Platform

Aurora is a commodity malware distributed through fake cracked software download sites and YouTube videos to other threat actors looking to use it.

YouTube has become an attractive distribution platform for threat actors looking to spread malware to access sensitive information.

Due to its mass popularity, YouTube has become one of the first choices for threat actors.

Hackers have found a new way to spread malware by hacking popular YouTube accounts and posting videos with malicious links or downloads through those compromised accounts or channels.

While the hackers also use optimized SEO tags to boost the visibility of videos in search results, which will increase the click-through rate (CTR).

Since threat actors are actively generating handsome revenue by stealing YouTube accounts for a fee, these services are now actively marketed by hackers in several underground forums and marketplaces.

Artificial intelligence (AI) is used by the service to generate videos, making it easier and quicker to create budget-backed content that looks convincing.

Victims who click on the links in YouTube video descriptions are taken to fake websites that trick them into downloading malware disguised as legitimate software.

To appear legitimate, these fake websites use the following things to create the illusion that they are real:-

  • Similar URLs
  • Similar logos
  • Similar branding

These decoy websites convince users to download applications containing malware and trick them into entering their sensitive or personal information.

Technical analysis

Morphisec asserted that this loader checks the vendor ID of a system’s graphics card and terminates itself if the value doesn’t match a list of approved IDs, which includes:-

  • AMD
  • Intel
  • NVIDIA

Using a technique called “process hollowing,” the loader decrypts the final payload and injects it into a genuine process called “sihost.exe.”

While injecting the final payload into the legitimate process, the loader dynamically decrypts all the required Windows API and uses the XOR key ‘in2al5d p3in4er‘ to decrypt the API names.

The loader employs Embarcadero RAD Studio to create executable files that can be used on various platforms, which helps it evade detection by security software.

Malware loaders like in2al5d p3in4er are the building blocks of an attack, providing an initial foothold between the attacker and the compromised system.

They serve as a crucial first stage, facilitating the delivery of more complex and damaging payloads.

The threat actors are responsible for in2al5d p3in4er malware are leveraging social engineering tactics and using them in combination with the malware to create a significant impact.

They target popular YouTube accounts to redirect the viewers to fake and legitimate-looking websites.

To prevent attacks from in2al5d p3in4er, educating employees about identifying social engineering schemes is crucial.

Source: Cybersecuritynews

Check Also

January 2025

TRACKING RANSOMWARE
Akira Topped January 2025 as the Most Active Ransomware Threat

In January 2025, there were 510 global ransomware incidents, with Akira as the leading group …

Leave a Reply

Your email address will not be published. Required fields are marked *