A new wave of cyberattacks has emerged, targeting YouTube creators through malicious collaboration requests that exploit the trust between creators and brands.

Cybersecurity experts have identified these campaigns as highly strategic phishing efforts, impersonating trusted brands to distribute malware.

The attackers use tailored emails with professional branding, sophisticated language, and enticing offers, such as brand sponsorships or promotional deals.

Within these emails, victims are sent links to download files purportedly containing contracts or promotional materials.

However, these files are weaponized with malware that, once deployed, can steal sensitive data, including login credentials, financial information, and even intellectual property.

2024 MITRE ATT&CK Evaluation Results Released for SMEs & MSPs -> Download Free Guide

The cybercriminals’ strategy involves sending phishing emails from seemingly legitimate but spoofed accounts.

These emails include password-protected attachments hosted via cloud services like OneDrive, with instructions designed to ease suspicion. Upon downloading and extracting the file, victims unknowingly execute malware that compromises their system.

Brand Collaboration Email

This malware not only extracts sensitive information but can also provide attackers with full remote access to the device, amplifying the potential fallout.

Malware Behavior and Techniques

According to the Cloudsek reports, the malware distributed in these campaigns is notably sophisticated, utilizing multiple layers of compression and obfuscation to evade detection by antivirus tools.

*Snapshot of malware connecting with 89.105.223.80 on port 27105*

Investigations into the attack have linked it to the “Lumma Stealer,” a notorious malware known for targeting sensitive user data.

In this campaign, the malicious payload is often embedded in compressed archives named to appear legitimate, such as “Contracts and Agreement Archive.”

Extracting these files reveals executable files masked as harmless agreements, which deploy the malware upon opening.

Technical analysis of the malware reveals its advanced capabilities. It uses functions to manipulate clipboard data, a technique often employed to steal cryptocurrency wallet addresses.

Templates used by threat actor to target brand

Additionally, the malware employs automated scripts via AutoIt, a legitimate scripting environment co-opted by attackers. These scripts help the malware execute silently, alter critical system files, and establish persistence on the victim’s device.

Communication with command-and-control servers ensures the continuous exfiltration of stolen data, including browser credentials, cookies, and confidential user information.

This campaign serves as a wake-up call for YouTube creators and professionals in the influencer and marketing industries. To safeguard against such attacks, experts recommend adhering to strict cybersecurity practices.

*Automation tools for sending spear phishing emails and other automation tasks.*

Creators should verify any unsolicited collaboration requests by reaching out to brands directly through official channels.

Suspicious URLs or password-protected archives should be avoided, and users should maintain robust antivirus protection and enable multi-factor authentication (MFA) on all critical accounts.

Educating teams and staying informed about the evolving tactics of phishing campaigns is equally important. Resources such as cybersecurity training and awareness programs can help creators and businesses identify and avoid suspicious requests.

Proactive measures not only protect individual accounts but also minimize the risk of broader damage to the creator’s brand and community.

This growing threat underscores the need for vigilance, as attackers continue to refine their methods to exploit human trust and technological vulnerabilities.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

The post Hackers Attacking YouTube Creators with Weponized Collaboration Requests appeared first on Cyber Security News.