Creator Alert
Hello Reader, |
Why this Alert?During December, we had several reports of various emails sent to YouTube Creators that contained a malicious link in them. From the examples we have seen, the email is typically a “Merry Christmas” style of email with a link to a gift certificate from a brand. Our thoughts:The email is well written and is probably created using AI such as ChatGPT. The sender has done some research. In each of the cases we have seen, the email mentions a specific brand that the Creator had worked with in the past. This makes the email more personal and believable. The email is made to seem as if it is sent from “an agency” tasked with sending the year-end gifts by the company. Out of all the emails we have seen, the agency is fake and doesn’t exist. How does this impact you as a Creator?Here is an example of one of the links – the others have a variation of this but all use the same DoubleClick domain.
The reason that your anti-virus doesn’t flag this email is that the domain is perfectly safe; it is a legitimate domain used by Google Ads. However, when you click on the link you are redirected to the second bit in the link which is where the malicious code is. When you get to that site, there is code that automatically runs and tries to install malware on your computer. At this stage, your anti-virus should block it. However, we have seen several cases where the code was allowed to run and that code took all the Authentication cookies and tokens and sent it to the hacker’s command-and-control servers known as C&C or C2. What should you do?If you get an email with a link, no matter how legit it seems, right-click on the link and copy it. Then head over to VirusTotal.com. Paste the link in the URL section and see if it is indeed safe or has been reported as malicious.
Want to know more?We go through this and how it is used to bypass your 2-factor authentication in the YouTube Security For Creators Course Check out that module for more information. Keep safe out there, The Security For Creators Team Was this sent to you? Sign up here. Want to secure your YouTube channel? Start here. |