Google block on 1.6 million scams that stole cookies

iGuRu.gr > Google block on 1.6 million scams that stole cookies

Google has blocked 1,6 million phishing emails since May 2021 as part of a malware campaign aimed at hacking YouTube accounts and promoting cryptocurrency fraud.

According to Threat Analysis Team (TAG by the Threat Analysis Group) of Google, which from the end of 2019 stops the cyber "fishing" campaigns carried out by a network of Russian hackers targeting YouTubers with "highly customized" cyber "phishing" messages and malicious cookie theft software . Cookies

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

The group's main goal was to hack YouTube accounts to host live-stream scams that offered free cryptocurrency in exchange for an initial donation. The group's other main source of revenue was selling YouTube channels for $3 to $4.000, depending on how many subscribers each channel had.

As of May 2021, Google reports that it has blocked 1,6 million targeted messages, displayed 62.000 Safe Browsing alerts, and repaired some 4.000 compromised accounts.

Fishing messages delivered malware designed to steal cookies from browsers.

Although the pass-the-cookie attack is not new, it is very effective: it does not bypass multi-factor authentication (MFA), but it works even when users activate the MFA on an account because the session cookie is stolen after the user has already been authenticated twice, by a password and a smartphone for example.

Once the malware runs, the cookie is uploaded to the attacker's servers, offering them the account on a plate.

Google attributes the campaign to a hack-for-hire group recruited to a Russian-speaking forum.

The hackers then trick the targets with fake business emails, such as an opportunity to monetize a demo for antivirus software, VPNs , music players, photo editing software, or online games. But then the attackers steal the YouTube channel and either sell it or use it to live-stream cryptocurrency scams.

Google also identified 1.011 domains created to deliver malware. The domains represented well-known technology sites, such as Luminar, Cisco VPN, and various games on Steam.

The company reports that hackers run malicious cookie theft software periodically to reduce the chance of being detected by security software.