The Latest YouTube Malware Scam

[@ignelis]

Hi John, they used a share function in KZbin. So they have a private video, so you can't see it, but the thing with private videos is that you can give access to someone. So they add your and other youtubers emails, so you would get this email from youtube, stating that this and this channel shared a video with you. In the email you can see description and title of the video. Once you receive that email - the scammers just remove access so you can't see it, that's why it says the video is private, but you got email from official youtube domain.

[@scoopet]

thats really clever

[@kazii_the_avali]

not only that this goes on quite often. just in other forms. paypal has scams like this. and yes the email does come from the offical website however its cause someone did something such as shared or requested something and thus is immatiting the offical source.

[@abhinavadarsh7150]

I tried. I wonder how they got to type custom email?

[@seanvinsick]

I think it might have been shared to drive and then shared from there to get the attachments? I thought the same thing about the share function.

[@CZghost]

@@kazii_the_avali Invoice, perhaps?

[@JackAllpikeMusic]

This is why whenever I receive an email saying like "Suspicious activity, you can reset your password at this link: [link]" I just close the email, go to the actual website - and change it through there rather than following the link. Can't even trust the email it's coming from now.

[@karmanderdimdung223]

never follow the link. if you have to, copy the email address and paste it on new tab. the link has 2 sides. 1 the actual link and 2 the display name. scammers/hackers use offical link address as display name while the actual link is hidden behind it.

[@lfcbpro]

Thing I love about John's community is I learn nearly as much reading through the comments as I do in watching the video. You guys are seriously awesome about filling in the holes and adding extra incite to a video. I don't know if anyone else commends the commenters, but keep it up you guys/gals, you are doing newbs like me a real service, thank you.

[@robonator2945]

6:45 Another thing is, 5:02 the zip file that created that executable was less than 10 megabytes, but the exec itself is around 700 megabytes. Compression can reduce file size, it cannot reduce it by several orders of magnitude. Unless of course 99% of the file is just the same data repeated over and over and over again, then it can.

[@karmanderdimdung223]

thiojoe made a video about this malware and apparently rest of the files are all zeroes. he opened the file in a hex editor, deleted all the zeroes and saved it which made the file few mbs and then uploaded to virus total for scanning. we could see all the zeroes in this video too 11:10 but he didn't scroll far enough to show us the mountains of zeroes.

[@James-King]

My first guess would be they've shared the "Private Video" with you via KZbin, and in the message they can attach along with that video when sharing is where they've added the Google Drive URL. Causing KZbin to send you a genuine email, from the legitimate KZbin email address, along with the shared video, and their phishing message. Because the message contains a Google Drive link, Gmail automatically "adds them" to the email at the bottom making them look like an attachment which is why you can see the .zip file immediately. It's especially scary given that even if KZbin terminate the account as they did with your first example, that email will still be in users inboxes, with links pointing to malicious stuff likely still up and available, meaning unless KZbin stop this before it happens, banning the account after does nothing but stop them sending out more from that account, which likely takes seconds to create a new one.

[@CypherX-Sec]

@user-wc2os5ft6v what the F**k . You know who is he 🤣😂🤣 John will trace you

[@RolandHazoto]

Someone should make a testing distro that's full of poisoned info. Like instead of the malware stealing info, it just steals malware. Has anyone ever done something like this? Is it even feasible?

[@__whitehawk__]

Yep. In industry it's called a "honeypot".

[@HowToCyber]

@@__whitehawk__ lmao

[@tarekrahman1]

it's an age old technique called honeypot

[@evandroescutatrap131]

@@__whitehawk__ LMFAO

[@jetalone00]

​@evandroescutatrap131 what's so funny about it?

[@zxljmvvmmf3024]

My guess is they didn't fake the mail address, they used a share function in Google / KZbin somewhere.

[@raghavkamath]

Bruh these bots are getting out of hand. Literally the worst channel to spam the scam.

[@EllaMaster]

My guess is they didn't fake the mail address, they used a share function in Google / KZbin somewhere.

[@olliflying]

SPF (Sender Policy Framework) specifies what servers are allowed to send emails for a domain. DKIM (Domain Keys Identified Mail) provides usually RSA public keys via DNS - emails are then signed using their private keys. The emails you received passed these checks, meaning they are definitely sent by KZbin's mail servers.

[@DarkFaken]

What's DMARC? I heard someone the other day saying we should be relying on that more as an indicator of illegitimate emails.

[@olliflying]

​@@DarkFaken DMARC is how you set what should happen to non-conforming email traffic. It is also set in DNS records. DMARC *requires* SPF and/or DKIM to be set. DMARC *does not* verify the senders of emails, it only sets out the policy on how non-verified emails should be handled. Here's an example record: v=DMARC1; p=reject; pct=100; rua=... p = the policy to use - none, quarantine and reject are available. Quarantine chucks the email to the spam folder, reject refuses to handle it entirely. pct = the percentage of emails to subject the policy to - used for testing usually. rua = the reporting email. Larger receivers like Google send statistics and reports to this email every once in a while. There are more options, but these are just the basic ones you may see.

[@papajohnscookie]

@@DarkFaken DMARC is the policy which tells receiving mail servers what to do with e-mails that either fail SPF & DKIM or are misaligned. It's a DNS record just like SPF & DKIM

[@EllaMaster]

SPF (Sender Policy Framework) specifies what servers are allowed to send emails for a domain. DKIN (Domain Keys ldentified Mail) provides usually RSA public keys via DNS - emails are then signed using their private keys. The emails you received passed these checks, meaning they are definitely sent by KZbin's mail servers,

[@DarkFaken]

Fascinating as always! I really appreciate the longer videos where you take time to dig into stuff a little bit more and show us some ways to extract information. Thanks!

[@EllaMaster]

Fascinating as always! l really appreciate the longer videos where you take time to dig into stuff a little bit more and show us some ways to extract information. Thanks!

[@MrLarki]

This is a notification email from KZbin when someone shares a video from YT with you (just like the google drive one for sharing a file from there). The attacker used the KZbin email template and changed it to look like an official KZbin email rather than a notification email. If you for example share this video with let's say David Bombal via email, he will receive an email from KZbin with this title: John Hammond sent you a video: "The Latest KZbin Malware Scam"

[@TimeWisely]

I see how this scam works as soon as I saw it the first time. It's literally the share feature, I love how everyone thinks it's this over engineered scam, whilst in reality, it's just a shared video that was generated by KZbin. Kind of stupid that a company this large allows you to do that.

[@bipolarminddroppings]

First thing I do with any email I wasn't expecting is check the header info to make sure they haven't spoofed the email address. Not sure how the hell they spoofed all that header info, maybe they used the private video backend to invite you to the video so it actually came from KZbin?

[@cybercrime_]

You can share videos via KZbin (it emails them), you can also add a description to that message when sharing. Google auto appends the Google Drive link as an attachment because it’s deemed as a ‘safe’ link.

[@bipolarminddroppings]

@@cybercrime_ that's a clever exploit.

[@EllaMaster]

First thing l do with any email l wasn't expecting is check the header info to make sure they haven't spoofed the email address. Not sure how the hell they spoofed all that header info, maybe they used the private video backend to invite you to the video so it actually came from KZbin?

[@oz457]

I have the feeling Internet is getting overwhelmed with scammers and nothing is done. It just goes that far that I start to get disgusted using Internet. I get scam mails through all means of communication channels. Out of 5 emails, 4 are spam, 3 are scams.

[@Buglin_Burger7878]

Email itself is generally useless. You have to go to the main site to do anything, so legitimate emails should say something and tell you to manually visit the site. This would in general render scam emails worthless since you'd visit the legit site and see it is false.

[@jd-raymaker]

To send an email from the youtube domain, simply upload a video, set it to private, then use the "Share privately" feature. Notice the email subject? "Channel name sendt you a video: Video title"

[@larrytoruan8918]

I don't know whether should we be worried by these attacks, or should we be entertained by these

[@parabolicpanorama]

personally I find it funny but it's probably a little messed up for smaller youtubers.

[@vanillafromnekopara]

Bot comment above lol

[@kiyu3229]

@@vanillafromnekopara huh

[@steelblade1984]

Hey John. First time commenting on one of your videos. I love the content and keep it up.

[@DerLung]

the download link isn't sus at all lol: "&confirm=no_antivirus"

[@LokiCDK]

Hey John, SCR can also just stand for "Script" file. I remember, was it black nurse? That relied heavily on this because it allowed for directly running scripts from any FQDN, not just local files, and got past TONS of heuristics scanning at the time, I think I have a malware sample for this somewhere. Because why would a file extension, on a file extension aware OS, be only one thing?

[@LiEnby]

Windows defaults to using .scr files as screen savers um

[@StabilizerTech]

The link says no antivirus 😂😂😂

[@takahashi5341]

😂

[@AlEbnereza]

I’d be laughing at the email from the get-go. So many subtle clues, and some just glaring.

[@PunkFiddler]

~700MB? Hmmm... xvid rips? Gododness, i'm so old.

[@minhperry]

I think I've seen this before, they just inflate file size by adding unnecessary bytes at the end of the file so the the antivirus would just give up since it's too big

[@4Bakers]

I see myself as safe from phishing malware because I'm not a celebrity/influencer, so I'm not targeted in particular, but mainly because I don't trust any emails I wasn't expecting in advance (and that narrows it down to 2FA)

[@DefCantGame]

Used to be an email delivery analyst and this was actually pretty common to see come through the office and we'd flag it

[@originalkhawk]

what really blows my mind, is that somehow, someone managed to either gain access to or managed to create a passable spoof for the youtube/google domain, which is scarry and impressive, yet the email still reads like a complete scam, i don't understand how someone can be so clever, but at the same time not able to write a email that looks real, because in my expiriance, writing the email is a lot easier then getting access to, or creating a passable spoof. i know not everyones first language is English, it's not mine either, but you would think that someone that goes trough this much effort to make the domain seem real and legit, would go trough at least as much effort to make the email seem legit.

[@LePedant]

CPG Grey just released a video saying, to "combat" the scam comment bots, he is only going to let people comment he can verify is human. Although, he is only going to verify people who pay to support his channel. So, I can't tell if he is genuinely trying to combat anything.

[@floorpizza8074]

Yeah, that's not going to work out well for him, for too many reasons to even begin to list here.

[@AntonioNoack]

Sounds like he's trying to combat the potential emptiness of his wallet.

[@karmanderdimdung223]

pay to --win-- comment

[@Nadia1989]

CGP Grey went from "if you are financially able, consider becoming a member" to "pay to comment or else"

[@Stopinvadingmyhardware]

It's almost like they aren't even trying anymore

[@atsekbatman]

Thank you. Informative as always...

[@notalessandro]

John Hammond the guy that turns scam attempts in youtube content and I dig it

[@KatelynGadd]

Fascinating that the .scr file had a digital signature, I wonder if they stole a signing key from someone

[@BeaverZer0]

Emails from KZbin to you, will have that very odd email address that KZbin has for you, it has dashes in it and everything. One way to thwart them is have a different email address on the "contact us" than the one that owns the channel. Then all emails go to the new email but get tagged to the other, non listed address

[@CZghost]

This is such an obvious trap, obvious shady stuff I wouldn't ever believe to be real. If someone falls for this...

[@courageousmelon5654]

4:00 the mail address isn't spoofed, that is why it passes on SPF and DKIM. The channel name You Tube (with the space in between) is spoofed. The email itself is therefore legitemately sent from Google's/KZbin's mailserver.

[@josephfrye7342]

That is why KZbin violated thier own terms of services too

[@porschepal7932]

Also that wasn't the CEO of KZbin. That was the CEO of Google.

[@RandomContentInc]

If KZbin actually did change the rules, then they would make a PUBLIC video and email you with something like "Effective [date], [info]." with a link to YT's help center article about the policy or something.

[@Lampe2020]

2:51 Nice to see that you also watch NetworkChuck and have to fight with these damn spambots XD

[@Buglin_Burger7878]

You can tell the email is fake because it asks you to do anything through the email itself. That is normally reserved for verification and other important things that happen because you were just on the site and waiting for the email. Email is not valid communication in of itself, it can only warn you to go to the main site for email to work. ...yet enough people use it as full communication that these scams work.

[@konnie_pon]

22:13 yeah, of course they have. and i’m sure there isn’t just one channel, there are a lot

[@Tristan-mr3pk]

Love your stuff man!

[@ultraret]

Give this man a rusted old rock and he will take 30 mins to tell you its not gold.

[@babaki1]

Yeah, they are emailing you from inside their youtube account. They are sharing a video, or messaging your from the platform, that why it looks legit.

[@stefandemerov8423]

You gotta look at the bottom most "Received-by:" line in an email header. Thats the originating server - check the network record on the IP and you know where its from.

[@Manavetri]

Another excellent video !!!, i love your content !!

[@deadbeef2482]

the 7 days deadline sounds like Samara from the Ring film lmao

[@CesSanchez]

Hi, subtitles are not available, may them be, please? Thanks a lot

[@cyberus15]

The sharing function of a private video is obvious, but how the hell did they add the description "This email has been sent..." down below? You can't add any description when sharing.

[@TheBenSanders]

Great video John, keep the long videos coming!

[@randomriddle539]

I am getting mail from no reply dropbox, haven't opened it though

[@MeariBamu]

why google don't stop and pause all no-reply youtube gmail?

[@NitraPunkie]

Someone please setup a bunch of scam sites but insted of asking for money let them know this is a scam and theyll ignore things like that from then on using the same methods scammers use to get customers

[@NitraPunkie]

Like emails with a link with an image saying ignore emails like this their a scam

[@jimkats1]

That's pretty cool indeed...for scammers. Why though it couldn't read first file? Packed differently?

[@breadmoth6443]

so did anyone think to report that fake yt team channel?

[@delusionalaar4031]

I love your videos. So good. I learn so much about what I didn't know

[@matthew6023]

In the upper left, under the senders email and next to the "to me" there's a down arrow that shows who the security of the email is signed by.

[@skeleton_craftGaming]

why are screen savers executable?

[@SansaStarkw]

i mainly delete youtube emails because they send you who has commended on your comment. maybe if people need to use emails. and i am sure people use Microsoft windows you can use What Are Disposable Virtual Machines, like Windows Sandbox Sandbox is a temporary isolated desktop environment where users can run untrusted or even just new software to test out before running it on their actual host environment.

[@CoachRichieJ]

John that’s absolutely insane all that Data In one file Thanks For tip Bud

[@jay.cee2000]

I love your Videos so much and I am really into this stuff. I am looking forward to be in the cyber security one day too.

[@CupidGaming522]

John: "..into an already very long video..." Me: Jokes on you I love these long malware analysis videos 23:50

[@rasydev]

Thanks for sharing

[@thewizardbrand]

I seriously wonder how they do this

[@balajisharathkumar9753]

have you analyzed the sender of this email

[@MichelleValenzuela-k3v]

What about the redirecting issue. Some videos or shows are blocked unless you follow the link in the comments. When you do right away, I get a warning that says it's a malicious website! The shows i pick dont contain bad stuff either. What do viewers do?

[@brbl415]

scary that they got the dkim and dmarc to pass with the youtube domain, huge breach and they can be sued

[@OpCoders]

me : getting ip info of sender

[@thefoxguy]

Antivirus software really needs to start checking a file if it is really that big or just a bunch of null or random bullshit appended to it.

[@Robdeltonie]

I forget which channel, but someone else on KZbin looked at this scam and played the video. It used deepfake technology to try to give the impression it was an official announcement from Google's CEO. The deepfake parroted the same info in the description of the video, as seen in the email. Chances are that they shared the private video with another channel you own and control. For example, if you run channels A and B, each with a different email address, and you list the email address for B on your About page for channel A, then, whenever someone shares a private KZbin video with you, it will only be available if you're actively signed in to channel B. If you're still signed in on channel A, you'll get a "This video is private" error message, even if you're technically signed into channel B. Once you switch from channel A to channel B, the video will be visible to you.

[@TheKaukas]

I knew SPF Record wont fix anything sooner or later...

[@corraldustaviation]

6:34 What is "ytscam" Are the blatantly saying this is a scam? 🤔

[@aiartrelaxation]

I would not tell people to check out the links from an obvious phishing scam that could be loaded somewhere with a virus.

[@fluffuwu1922]

Nohin else like watching a video about scams and getting a scam ad

[@Discretion_Advised]

This is same scam but the dumbest one so far. If you have the knowledge, you can easily turn the tables.

[@TheKaukas]

Amazing video, keep it up.

[@drugoviic]

this video felt like it was only 3minutes long

[@arminbarzegar2171]

Suppose they used the Share Option, How did they manage to write a custom email and attatch the zip? , and it couldnt be email domain spoofing cuz youtube has dmarc records for that, kindly reply if you know more about this

[@edgecrush3r]

Holy shit. Seems to me Google has some spf flaws, or can this be spoofed otherwise?

[@Vampirat3]

Hey John , when these videos go into a more scammer type side , there are people for that. There is a guy named pierogi who exclusively does internet scams , Big youtuber , You should definitely collab with the guy , you all could use each other. Both good professionals together working on a resolution maybe? Aaaaaand, So , should I start flooding that email for you now , Or later? Aaaaaand This is just another side reason , why we all should not be so reliant on devices and be more diligent. Thanks for posting!

[@girl4632]

Can't you go after that Gmail and domain name and catch that person using help of Google and hosting providers

[@aquatrax123]

If DKIM and SPF records are correct than yes, this email came from KZbin server. I would love to see the message headers because something more might be in there.

[@cheeseIT1992]

Sooo... What are the steps concerning that control server now? When you take that down/over, all connected infections are useless right? Of course it's something for law enforcement from that point, but who and how is going to proceed killing the threat?

[@redspotaquashrimps]

Every single of your videos are very interesting to learn. But, how do you find All the time to make videos, edit it and make corrections (unless you have a Team behind) besides your full time job man? Don't you get Burn out sometimes of pressure of creating constantly, posting all the time?

[@casualamber]

Potential compromise of a youtube server?

[@DonDonDonDonD]

Done well 👍

[@wtfdoiputhere]

Noob heee : so how'd they spoof the email domain?

[@Rhyl4x]

I love these videos - funny when you see a hacker trying to hack a security expert :P

[@StabilizerTech]

Wow what a genius 😂😂

[@konnie_pon]

21:44 there are a lot of those these days. you can find a lot of those in russian communities, these people most likely sell these files for people

[@Traxexdota2]

Guys i got it today and had no idea. I clicked on the shared pricate video and it led me to youtube video as i was on mobile device. But i didnt see the zip file. I didnt click on any link that was in youtube video description. Should i be worried about clicking the video?

[@Bogec]

Hello John. Maybe a stupid question, but how to check if the link is real or fake. If, for example, it is fake and I click on it or copy and paste it into the browser, it is possible to pick up malware. Do I have any method or other possibility to check it? Thanks for the video and your warnings..

[@scoobsmcgee9325]

I use a rotating series of screenshots as my screensaver. Checkmate. (no way that could end embarrassingly)

[@Donder1337]

Damn, its getting worse and worse 😂

[@iam-py-test]

Seems like a lot of KZbinrs have been getting this recently.

[@ryelo5448]

Hey just notice there seema to be a bot in the comments replying to comments with the base comment?

[@cybersorcererssecurity9639]

I can teach you about email but I'm in the process of starting my own security channel figuring out what to do that isn't already covered. I have about 25 years expeience as an independent security researcher speclizing in malware & vulnerability research. But if you are serious about it hit me up and we'll see if we can put something together. I believe I'm in your Discord too? I'll have to check because I'm in a lot of Discord channels for different niches too.

[@guilherme5094]

👍

[@lexintrus]

"goowey" 6:27 :)

[@Sombre____]

"Confirm no antivirus" is suspicious in the link

[@samha1513]

Th confident he clicks on those links 😮

[@Ausf.D.A.K.]

You need Kaspersky to protect you, bro.

[@AvengerDCFan13]

OMG IM CRYING 99:59:59

[@AvengerDCFan13]

lol i just did it for a joke im not a bot lol

[@AvengerDCFan13]

100:13:13