Lately, there has been an increase in the number of stolen YouTube credentials being sold on hacking forums.
The number of subscribers plays an important role in determining the price
Cybercriminals have been targeting YouTube channels for a long time.
Some simply hack channels and demand that the rightful owner pay a ransom to get them back. YouTube community support has been flooded with complaints from users who lost access to their channel and were asked to pay a ransom.
Stolen data mainly comes from infected computers and phishing campaigns.
Researchers at intelligence firm IntSights found that there is increased demand for YouTube credentials on hacking forums and underground marketplaces.
The value of the offered credential lists is based on the number of subscribers. For example, the price of credentials for a channel with 200,000 subscribers starts at $1,000.
Some hackers have put up an auction for 990,000 active YouTube channels, with prices starting at $1,500. Anyone who pays $2,500 wins without even having to bid. The sellers are moving quickly and trying to make quick money as victims report the problem and claim access to their accounts.
A set of 687 YouTube accounts, categorized by subscriber count, were available for a starting price of $400. Anyone who paid $5,000 would get it immediately.
Another hacker was selling credentials for 25 YouTube channels. Some of them have over 100,000 subscribers. The price starts at $600 (direct sale to anyone who gives $2,000).
Social engineering
Etay Maor, Chief Security Officer at IntSights, says that the stolen YouTube credentials likely come from databases of Google credentials and infected computers.
Users reporting account hacking on YouTube say they were tricked into downloading malware onto their computers.
“They said they were YouTube sponsors and when I tried to visit their site, a keylogger/spyware to browser . They changed my password , removed my known devices, removed my recovery phone number and emails within about 2 minutes. Then, they tried to blackmail me into sending them btc. They threatened to sell my channel if I didn’t,” said a YouTube channel owner.
Another victim reported a similar story. In this case, the scammers said they were looking for partners.
Maor says past attacks relied on sophisticated phishing campaigns and reverse-proxy toolkits that bypassed Google 's two-factor authentication ( 2FA ) barrier.
