New YouTube Scam

[@Endermanch]

This channel was not hacked. I NEED HELP. My channel is about to get terminated. I can't upload any videos for a week. Here's the overview of the situation from my second channel: kzbin.info/www/bejne/d4vJf6eKgdN5qs0

[@hgijhsjos6288]

i swear youtubes getting worse and worse... by 2030 there would be no channel on youtube xd

[@Yarpopcat08]

Damn, I KZbin doesn't care a bout bots and scamming, but it cares about destroying channels. I hope everything will be good with Your channel. Good luck

[@SusuLakuProductions]

Well, R.I.P to this channel, it was a good run

[@morganpg]

​@@Yarpopcat08they do care about scams but they don't put enough effort into it, i reported one and it was gone in a day but that was one out of the millions of scam channels

[@jaquesecraft]

Welp, this happened to other yt creators before, you're not the only one who is having problems in the ytverse.

[@ThioJoe]

Pretty sure they literally deepfaked Sundar there

[@de-y]

I'm guessing so.

[@JustinAds]

Hi thiojoe 😎

[@LavaCreeperPeople]

ok

[@justincodingprojects]

True. It looks like the deepfake's lips don't even sync to the audio, and even then, the audio is quite not very natural.

[@DylanKluxen]

O

[@shadowcomputing]

It's actually not a keystroke logger. When you run the file, it steals the browser cookies that keep you logged into KZbin. Once the scammers have the cookies, they can put them into their browser and have access to your account without a password or 2FA. They then change the password and 2FA, and you have lost your account. It's quite effective once the victim falls for the scam.

[@tubbunny]

Some different variations don't steal your browser history or any of that. They steal your cookies and session key, which lets them login even if the password gets changed.

[@raaymonf]

It's basically a KZbin cookie logger. I am safe, I don't use KZbin enough.

[@patrickboyd8937]

@@tubbunny so how do you get rid of it?

[@ql440]

@@patrickboyd8937 Cookies?

[@Akjjf6628]

No matter the variations what the scammers are trying to get at is a session token/key for your account; that is how they would bypass the 2fa.

[@Touhouuu]

We need a petition to make a major policy to never open email files unless requested on most sites.

[@LavaCreeperPeople]

yes

[@tonysolar284]

Yeah, good luck.

[@kyoudaiken]

Not clicking links or opening attachments is good practice. When I order stuff online, I always log into my account at the shop and download the receipt there.

[@chrideefer]

I REALLY HOPE YOUR CHANNEL DOESN’T GET TAKEN DOWN I’VE LEARNED SO MUCH😭😭😭🥺🥺

[@EmreFez]

It would just be very sad if they took his channel down like that..

[@JacksonGaming092]

Yeah, I Am A Really Nerdy Person And These Videos Inspired Me To Be, They Were Funny And I Liked Learning About New Stuff Every Day He Uploaded A VIdeo

[@realgptv01]

I would cry non-stop if Enderman was banned

[@marcostark8926]

KZbin. Stop striking Enderman.

[@mikeychowster]

I would find it odd that the CEO of Google and Alphabet reaching out to their creators. Pretty sure Sundar Pichai would have more important things than to make this video. However, CEO of KZbin is currently Neal Mohan. It would be Neal's responsibility for overseeing KZbin.

[@ФеодосийскийМаппер-в5е]

Wait, it's not Susan anymore?

[@nexusliteos]

@@ФеодосийскийМаппер-в5е New enemy basically.

[@katrinabryce]

@@ФеодосийскийМаппер-в5е Since about a month ago.

[@TorutheRedFox]

@@ФеодосийскийМаппер-в5е she stepped down and now we have the person who got dislikes removed and pushed for nfts on youtube as ceo

[@sofiaknyazeva]

No he didn't. Dislikes were been removed earlier when Susan was the CEO.

[@oosha2000]

I'm sorry about it. I have been watching your videos for 3 years or so since the COVID-19 lockdown, your videos were really entertaining and educational at the same time. Due to college tests starting from next Saturday, I haven't watched your videos for a while. I hope it will be resolved.

[@kbhasi]

(1:19) I remember seeing a similar thing happen where Google Drive was being abused instead of KZbin. Gmall were smart enough to file those as junk mail as they were sent to many random Gmail addresses.

[@justrampy]

i still get them lol

[@catminer7436]

I get some [REDACTED] pdfs files, of certain things for no reasons in my email

[@funduck2015]

@@catminer7436 hey, a fellow [big shot] what exactly is [in there]

[@catminer7436]

@@funduck2015 let's say it was some NSFW things

[@funduck2015]

@@catminer7436 oh, how {boring}

[@SapphFire]

Wow the CEO himself made a video about the monetization policy change. What a dedicated man.

[@Sunny_chips]

lol if that actually was legit it would be put on godly rarity

[@SirensOfNC]

​@@Sunny_chips fr

[@T_nology]

14:00 You can likely use a Hex Editor like HxD instead to remove a bunch of empty bytes (assuming that's what is inflating the file size).

[@LavaCreeperPeople]

ok

[@rabbitdrink]

ok

[@folddyy]

ok thank you information that we totally needed to know 100%

[@parrot20yt]

ok

[@ripooof]

this is actually helpful information thanks

[@TheGreatYS]

Everybody: fears that their channel could get hacked Enderman: AHH YES, FINALLY, A SCAM MAIL!

[@Gamer-ct6hb]

kzbin.info/www/bejne/d4vJf6eKgdN5qs0 The scammers did know the time that he was going to be striked.

[@TurboLight]

"Download document for Windows" People that have Linux: 0:19

[@SkyKrye]

definitely the based moment of all time

[@btarg1]

Their deepfake of Sundar changes from a British accent to an American accent halfway through

[@SkyKrye]

Such scams feel so legitimate and well as long as they don't screw up over small things like theze

[@wjgthatsit2357]

I hate it when cybercriminals try to impersonate a real company

[@LavaCreeperPeople]

fr

[@Your_Local_Weirdo75]

fr

[@monnamonsta]

fr

[@synthwavesoundscape1893]

Ong

[@TeamHELPER]

fr

[@KiingDJ141]

It's actually pretty scary to see what hackers/scammers can do these days, wow...

[@UCyAn7sD-VHF2H9KDasGpUng]

This isn't that well set up but yeah -- they could've done better

[@KiingDJ141]

@@UCyAn7sD-VHF2H9KDasGpUng i would definitely believe that

[@LavaCreeperPeople]

yes

[@НемањаСтарчевић]

Like girls on instagram >D

[@sihamhamda47]

They even use similar looking characters called "cyrillic characters" to impersonate official e-mail addresses, so most people couldn't spot any difference unless they do some checking using the "unicode identifier"

[@emblemi6345]

11:45 also deactivate from any other login session using the non-infected device (a phone for eg). The stealer uploads session cookies which works in some site even after password change.

[@GavAttackO]

How are they sending emails from the KZbin domain? Also, so much for the "Scanned by Gmail" feature doing absolutely nothing regarding this. With a company as large as Google you'd think they could run a virus check for larger files. Of course though scammers will just artificially increase the file size even more to combat that.

[@GavAttackO]

I actually found the answer to this question from a comment in another video. I'll copy and paste it here for convivence. Original Commenter: Ignelis Comment Source: "The Latest KZbin Malware Scam" from John Hammond

[@GavAttackO]

"Hi John, they used a share function in KZbin. So they have a private video, so you can't see it, but the thing with private videos is that you can give access to someone. So they add your and other youtubers emails, so you would get this email from youtube, stating that this and this channel shared a video with you. In the email you can see description and title of the video. Once you receive that email - the scammers just remove access so you can't see it, that's why it says the video is private, but you got email from official youtube domain."

[@realcomputerdude100]

@@GavAttackO but then how would the archive get attached to that e-mail?

[@amongsussyballs]

@@realcomputerdude100 its in the description of the video?

[@realcomputerdude100]

@@amongsussyballs I've never heard of being able to attach a file inside the description of a KZbin video. A link to the file, I could understand. But the file was attached *in the e-mail.*

[@Cairillic]

Я не могу не пожелать тебе удачи выжить в этом недоразумении Ютуба. Ты стал жертвой людей, которые ради своей забавы хотят удалить все твои каналы, думая, что они всесильные. Справедливость должна восторжествовать, и я надеюсь, что этой ситуации дадут больше внимания.

[@junior-gamer-410]

I wonder if they shared a private video with the description as the scam message. Would make sense why it says Shared a video with you

[@ls190v2]

(Slow clapping) Way to go, scammers.

[@LuneLovehearn]

We need Linus Sebastian and LMG to watch this now. Btw, run it on a Linux or Mac system with wine to see what it can do.

[@Capiosus]

"hey, if you do not sign the document you are banned from KZbin, also we do not have a linux/mac version"

[@AvidSonicFan]

I would love to see the OSFirstTimer guy try the latter! After all, he did respond to phone-based tech support scams that say his Windows computer has a virus, saying "Sorry, I use Ubuntu".

[@yd59_yd]

Run ît on a Windows computer

[@LuneLovehearn]

@@yd59_yd i can't as I don't have windows and I wouldn't as ik what it does.

[@STCatchMeTRACjRo]

you can do the same in a VM

[@kyoudaiken]

It's time for a class action lawsuit against KZbin/Google. No mentally stable person would share a video using the share function via email. This makes no sense. Yes it's a feature from the late 2000s but still... This really feels like negligence. Why did this not have been removed years ago?

[@hostolis]

We should be able to set an anti-phishing code/passphrase on sites, so that when a real email comes from the company it contains this code. If it does not contain the passphrase we set, it should ring a bell that it’s a phishing/scam email.

[@WindowsDaily]

This isn't anything private, but usually, that would be your KZbin channel name in this case, to at least prove its for you and not just spam.

[@debugbri]

ayo! nice video. i miss sometimes old video type like showing how virus works (like petya). i still like this type but would be cool to see more malware videos!

[@xw591]

11:26 What does it mean to "force shadow" the computer?

[@andresbravo2003]

Somehow this isn’t official, it’s a fake message which is a scam.

[@vajoexe]

BTW if You look at the subscriber count, and see that it's fake. Also I don't know they would private the video, they have them public and I would also compare the name (not the display name but the name with the @) with the real and fake KZbin channel.

[@in1]

You might also want to pin a comment with the video here. If that's even possible... I'm not sure abt the editing rights, but you could also add a "showcasing purposes only" disclaimer into every description, maybe that influences the algorithm. Good luck, let's hope there will be a real human looking over it before they can terminate you and your communication attempts are more than speaking to a wall.

[@superNova5837]

Starting to think KZbin should move communications to KZbin studio

[@alejandroalzatesanchez]

The "Anti-anti VM" i didnt expected that XD

[@PaddyPatrone]

Stupid me downloaded the thing because I was scared of loosing monetization ( I know im stupid). I opened the zip but did not touch the document in it. My question now, am I safe or did it already infest my system?

[@violentvincentplus]

Hopefully ur safe

[@PaddyPatrone]

@@violentvincentplus Just changed all my passwords on another computer. Hope that helps.

[@dark-mode.]

@@PaddyPatrone Did you open it. If not, you we're completely fine.

[@AWIRE_onpc]

Notice the "confirm=no_antivirus" in the URL. Wonder what that does 🤔.

[@yotoprules9361]

it skips the antivirus prompt that google drive has

[@AWIRE_onpc]

@@yotoprules9361 I know what it does… I was making a joke.

[@DmitriLeon2000]

I witnessed something similar back in February 22 of that year. This time, it's with Playrix's job inquiry through DeviantArt's Chat.

[@IslandiaBallerOficial]

hey enderman i noticed this youtube team account only has 719 subscribers

[@croozerdog]

i might be thinking too simple about this, but can't MS just warn users like if theres a . followed by 3 letters in the name before the actual extention?

[@ArturoDrives]

I noticed after a while that I hadn't gotten any notifications from KZbin about you uploading. That alone had me a little bummed. But when i saw the title to this video. My heart truly started to melt. I absolutely love your videos and simply the thought of your channel being terminated brings a tear to my eye. Hope you get through this with your channel still in tack. I wish only the best for you Andrew 🙏

[@dareallando]

.scr also prevents window's smartscreen from coming up when running it.

[@kyoudaiken]

Time to make this extension non-executable in the registry.

[@ik2a]

That's why do I think that LTTs rented out their account.

[@TheStarscouts]

Just a note, the email is actually from KZbin, it's using the share feature to send a video containing that malicious link

[@Aera223]

Ahh.

[@roundabout-host]

Why does Windows never show extensions by default

[@velja1312]

Ah yes, I love when KZbin Team shares a video with me on KZbin. This video's good to make me forget about polynomials assignment I've got to do.

[@DellieYT]

Works this virus file on IOS? Or only windows?

[@potatogmod]

Hey Enderman, I have a idea. Making an Windows based OS that just launches a program and that's it, and you cant do anything else. We will use Windows PE For this process, I have tried so many times but i get the same error or just bigger errors and i don't have enough brain for it. This is how i imagined: Windows PE Launches from ISO/any boot-able Source, Installs necessary files as like system32 and the libraries, Installs some drivers for the program to run at all, Restarts. Launches the Program and that's it. Could please do a topic on This?

[@comoyun]

That's some next-level trickery right there

[@gabri5381]

If the ceo of Google sent me a video about the policies of KZbin changing I wouldn't believe that in the first place

[@otto_ueue]

When some russian guy (probably with one of his arms broken) has to tell you not to execute files from e-mails, there is something wrong you had just done.

[@rialbbe]

That's why all my friends in youtube has a backup channel in odysee, rumble and tilvids

[@pb-doslegacy2020]

Can you do "Upgrading" from Windows Longhorn to Windows XP? (it requires a special application called "Application Verifier")

[@memes_minecraft90]

5:10 if you pay attention to the guy's lips you can see that its not syncing with the voice. giant red flag

[@2038Ounnak]

notice how the description is unupdated that’s great.

[@JaronWizard]

Enderman's the type of guy to install windows 11 on a potato

[@SkyKrye]

tbh that's exactly 1gb windows

[@wilson228]

I already saw something wrong as the file protected as said in the email. Just a rules and policies document why they need to encrypt it

[@Kirby_2048]

Well, that's called common sense, you got the common sense that it automatically flagged your suspicion into a big BS alarm

[@DonatoMaster10]

But HOW? Google doesn't let you make an account with the same email as another account! How did they bypass this?

[@kyoudaiken]

The scammer created a channel called KZbin Team and uploaded a deepfake AI video with the text of the email in the video description. Then they use the share function from KZbin to send it to their possible victims. That's why the sender looks legit because it comes from KZbin itself. The email contains the text of the video description and the layout KZbin uses is the same layout they use for official emails. To me, this looks like negligence from Google/KZbin and they should be sued for this.

[@Yukiyonova]

"no ones gonna run this file" i wonder to what happend to linus drop tips

[@thyrandomchicken]

i'd like to see the malware! (also i thought you used chrome not edge lol)

[@AnthonyTheMoonGuy]

This is why I watch out.

[@b3njaminfretez]

Screensaver? For me those are AutoCAD scripts. 😉

[@fightingfalconfan]

If you listen and look closer at the last bit of the video of the CEO of Google, you can tell it was a voice over the original. His mouth movement and what is said in audio doesn't match.

[@thisusernameistaken.]

heck yeah i realized it

[@TurboLight]

I don't understand how almost every scam has bad grammar which gives it away.

[@kirill9064]

It is Google Translate

[@iamanastronautt]

Where do you get your MP3’s from?

[@Oweblow]

The deep-faking levels here are scary. I think deep-fakes should be illegal.

[@Disbanded9998]

Nah it's fun

[@Disbanded9998]

And I like making SpongeBob say the n word

[@koukilfs]

i mean it's only really viable for memes and stuff apart from this, but if you have a keen eye, you would see that the channel isn't official either way

[@Oweblow]

I can see the channel’s fake, but the deepfake is scarily fake.

[@lore-g5h]

I AGREE 100% AI generated videos and pictures absolutely creep me out, no matter how perfect they may be.

[@DanTDMJace]

I see what they did. They shared a video via email.

[@yousefslimani99]

So did he trashed that phishing e-mail or not?! (I also got a phishing e-mail on my Gmail too yesterday!)

[@KeinNiemand]

Big companys like google, youtube(owned by google), amazon, facebook, ... should really just sign their outgoing email using SSL certificates, that user can just look for the little checkmark (or however the users email program/website/app shows it) to see wheter or not the email is real or fake, just like the litle padlock in the browser. But for some reason nobody using SSL email certificates. Wouldn't help in this case but it would help against some types of email spoofing (where they just change the sender adress)

[@janekple]

hey everyone he has 1 strike WE NED TO HELP HIM NOW pls if u can pin it

[@fahad_hassan_92]

Finally a chad who has the taskbar on the top

[@benjaluth07]

Have it too lol

[@HuangShengHong]

Naming a KZbin channel KZbin should not be permitted in the first place

[@goofertaten]

Have you uploaded it to the github repository? i'd like to take a look at it.

[@influxional]

Next video pls! Downloading malware on MacBook

[@michaelnolan1715]

12:46 thats .NET framework (it is just launching that because that scr was a .NET app)

[@Windows_NT_Dude]

When YOU don't TUBE the KZbin, you get scammed. Stay safe guys.

[@STCatchMeTRACjRo]

One way to prevent getting tricked by this type of scam is changing the way .scr files are opened. Create a new action for the scr and set it as default. For me, i created action 'open2' and set it to open 'notepad.exe "c:\Users\Public\screensaver_warning.txt"'. Windows will still launch screen savers normally, just the user will not. Also by right clicking it, you can still launch it using 'Test' action.

[@casualamber]

Now we gotta develop a scanner that can scan files that are under 1GB in size.

[@thanthanasiszamp4707]

Or a 1 Exabyte size file

[@FadhilAbdillah83]

is this right? generate me 30 sets of strings in the form of "xxxyy-OEM-NNNNNNN-zzzzz" where "xxx" is day of the year between 001 and 366 (for example, 192 = 10th july) and "yy" is the year (for example, 94=1994). your range is from the first day of 1995 to the last day of 2003. "OEM" mus remain intact the "NNNNNNN" segment consist of digits and must start with 2 zeroes. the rest of the numbers can be anything as long as their sum is divisible by 7 with no remainder. the last segment "zzzzz" should consist of random numbers. "z" representing a number.

[@kreshn]

Probably a variant of Redline

[@lolman6724]

Cool video. I had a video idea that is impossible. Install windows on a hdmi cord

[@SteelBlueVision]

So, basically, the entire premise of this scam consists of assuming that the file is a PDF file, just because it comes packaged with a PDF icon in the executable. This is combined with completely ignoring the simple fact that this so called "PDF" file just happens to have a .scr extension.

[@okrainz]

Most pc noobs have file extensions off

[@axollenvr]

what happened to your "limbo free download" video?

[@ahmetdenizsezgin]

Same question here

[@mcrzy]

mrbeast, e-mails, deepfakes, youtube scammers find every possible way to scam

[@Space_US]

DUDE! You use edge!!???😂😂😂

[@MUDA_MUDA_MUDA_WRYYY]

Silver Chariot Requiem is always a problem 😂

[@lazlar14]

Even since I haven't got anything, looks like I'm good for a moment. Thanks for alerting us!

[@ClayTheFoxx]

Just noticed, HE WAS USING EDGE OMG

[@Akotski-ys9rr]

How did you not instantly notice it was a deepfake bruh

[@MercuryKurogane]

I didn't either on first watch, I wasn't really paying close attention but looking back you can notice

[@Wormetti]

Not even a good quality one, the voice sounds so robotic.

[@KliqHP]

fr lol

[@lexxxxxxxxxxxxc]

random question but do you think you'll ever make merch?

[@swapnil3838]

Hello which software you use to trace that file exicutive location plz tell i mean which software you use to find that virus location

[@synthwavesoundscape1893]

"720p can't see crap" *happily watches in 144p, since my internet is too slow for anything higher*

[@kirill9064]

I have full ram and BOINC on all cores and gpu, so when youtube unswaps, it reduces quality.

[@shxrkdotdev]

I was listening to one of my playlists on spotify, and I heard your intro music! Is it Drive Slow - Windows 96? Anyways, I love your videos and they have inspired me when creating code. I hope to keep watching your vids.

[@cdkw8254]

I have a question: If I download a virus that steals my data and uploads it to the user and run the virus, will it work if my internet is disconnected?

[@r136a1_astronomy]

You mean "If my internet is disconnected, the attacker will be able to steal my data". If you mean that, the answer is no.

[@inputvol.280]

what is sim.exe on your desktop?

[@eddyfromnorway]

The download link from Drive has "no_antivirus"... Is it the imposter?

[@gengar-1997]

I remember GroovyDominoes52 being scammed by a similar scam. BTW, I'm using Windows 10 22H2, an OS I highly regret using.

[@SkyKrye]

that's a funny way to spell spyware

[@gengar-1997]

@@SkyKrye lol

[@kuntercode]

What VMware version do you use?

[@dark-mode.]

16

[@NaraSherko]

KZbin if you see this, Dont terminate Enderman. (pin this)

[@InoriMaster11]

Bruhhhh he dubbed the clipped, Listen to the Audio and watch his lips. Scammers tried to lipsync his short clip

[@tom23rd]

Whatever his mouth moves separate to his voice sounds

[@diffdimgamerseven9986]

well in this cakes, i shall rename the cookies into pancakes now that's a pastry joke my friends

[@alirezafarzin9341]

Hello, I have vmware workstation 17.1, when I turn on the virtual machine, the vmware logo does not appear when I press the esc key to go to BIOS, that is, I installed Windows XP, the Windows logo does not appear, the welcome message appears directly.

[@XSonicRBLX]

Great to see you uploading again!