YouTube Users Targeted By RedLine Self-Spreading Stealer

Risk actors have executed a campaign relying on the RedLine stealer and focusing on YouTube consumers.

The information arrives from cybersecurity scientists at Kaspersky, who released an advisory about the campaign previously nowadays.

“Discovered in March 2020, RedLine is at this time a single of the most common Trojans utilized to steal passwords and qualifications from browsers, FTP purchasers and desktop messengers,” wrote Oleg Kupreev in the technological write–up.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“It is brazenly accessible on underground hacker community forums for just a couple of hundred pounds, a comparatively small price tag for malware.”

According to the security expert, RedLine can steal usernames, passwords, cookies, bank card particulars and autofill info from Chromium– and Gecko–based browsers. It is also able of obtaining data from crypto wallets, immediate messengers and FTP/SSH/VPN shoppers and documents with unique extensions from products. 

The malware can reportedly download and operate third–party software program tools, execute commands in cmd.exe and open one-way links through the default browser. 

“The stealer spreads in many ways, such as by way of destructive spam e–mails and third–party loaders,” Kupreev defined.

Further, in addition to the payload alone, Kaspersky noticed that the learned bundle experienced self–propagation functionalities. 

“Several files are accountable for this, which receive video clips and post them to the contaminated users’ YouTube channels alongside with the hyperlinks to a password–protected archive with the bundle in the description,” the advisory reads.

“The videos market cheats and cracks and supply guidance on hacking common games and program.”

From a specialized standpoint, the bundle is a self–extracting RAR archive made up of quite a few destructive data files, thoroughly clean utilities and a script programmed to routinely run the unpacked contents. 

Kaspersky reported that the self–spreading bundle with RedLine is a prime illustration of stealer–type malware remaining distributed below the guise of sport hacks.

“Cyber–criminals lure victims with adverts for cracks and cheats, as well as instructions on how to hack online games,” Kupreev mentioned.

“At the exact time, the self–propagation functionality is implemented using somewhat unsophisticated program, such as a custom-made open–source stealer. All this is more proof if any were being essential, that illegal application need to be dealt with with extreme warning.”

The Kaspersky advisory will come times right after a report by cybersecurity company Akamai recommended cyber–attacks in the gaming sector have greater by 167% in the last calendar year.

As for the RedLine stealer, the instrument was also spotted in a ModernLoader campaign uncovered by Cisco Talos past thirty day period.