Cybersecurity firm Kaspersky: Hackers blackmail YouTuber for promoting crypto mining Trojan

On March 12th, cybersecurity company Kaspersky discovered hackers threatening YouTube content creators with copyright complaints, forcing them to add the SilentCryptoMiner encryption mining Trojan in the video descriptions. This malicious software is based on XMRig and is used to mine cryptocurrencies such as Ethereum, Ethereum Classic, Monero, Ravencoin, and controls a zombie network through the Bitcoin blockchain.

The hackers' main target is a YouTuber providing tutorials for installing the Windows Packet Divert driver. They first file false copyright complaints against the videos, then contact the creators claiming to be the developers of the driver and requesting them to add malicious links. It is known that one YouTuber with 60,000 followers fell victim, leading to over 40,000 downloads of the infected files, with Kaspersky estimating at least 2,000 devices have been infected.

Kaspersky security researcher Leonid Bezvershenko warns that hackers are exploiting the trust between YouTubers and their audience, and such threats may spread to platforms like Telegram. He advises users not to trust tutorials that require disabling antivirus software and to verify the source of any downloads to prevent infection by encryption mining Trojans.