Investigators uncover crypto scammers baiting ‘phish’ hooks on YouTube

A
report
reveals
a
new
network
of
malefactors
in
the
lucrative
crypto
fraud
market
using
videos,
channels
and
web
apps.

Helsinki-based
security
firm
WithSecure
has
unearthed
a
kudzu-like

network
of
fraudulent
content
aimed
at
getting
people
to
invest
in
fake
cryptocurrency
investments.

Run
by
what
WithSecure
characterized
as
a
group
of
around
30

threat
actors,
the
network
encourages
participation
in
web-based
apps
posing
as
investment
schemes
using
the
cryptocurrency
Tether.
The
company
estimated
that
the
fraudulent
apps
it
discovered
were
able
to
generate
just
over
$100,000
in
revenue
from
approximately
900
victims.

Jump
to:

How
the
YouTube
cryptocurrency
scam
works

WithSecure,
which
garnered
data
for
the
report
in
the
latter
half
of
2022,
claimed
the
malefactors
disseminated
thousands
of
videos
garnering
engagements
from
viewers
across
hundreds
of
YouTube
channels.

The
group
uses
Telegram,
which
was
a
vector
used
by
the

Keona
Clipper
malware
last
June,
as
a
communications
channel
and
deploys
copy-paste
automation
to
add
comments
to
the
videos
to
camouflage
them
as
legit,
per
the
security
firm.

The
investigators
found
700
URLs
hosting
fraudulent
web
apps
associated
with
videos
and
served
by
the
network,
but
parallel
data
from
cryptocurrency
wallets
“implicated
the
possible
involvement
of
thousands
more,”
said
the
report.

SEE:

FBI
warns
of
phony
cryptocurrency
apps
aiming
to
steal
money
from
investors
(TechRepublic)

According
to
the
report,
victims
transfer
money
from
an
existing

cryptocurrency
wallet
to
one
of
the
apps
in
a
one-way
transaction.
The
researchers
said
there
was
no
movement
of
crypto
back
to
the
victims
(Figure
A).

Figure
A

Victims
are
required
to
create
an
account
in
the
advertised
app
delivered
as
web
pages,

mobile
applications
or
even
automation
that
interacts
with
users
on
Telegram.
The
victim
must
then
deposit
a
small
amount
into
the
app
—
tens
of
dollars,
which
is
immediately
filched
by
the
scammers.

WithSecure
said
many
of
the
videos
encourage
victims
to
invite
friends
and
family
to
participate,
dangling
a
small
amount
of
money
for
each
person
invited.
The
apps
also
include
bonus
“VIP”
structures
that
unlock
better
“investment”
options
that
boast
higher
returns.
These
demand
a
larger
deposit
commitment.

SEE:

Visa
breaks
down
$9
billion
investment
in
security,
fraud
initiatives
(TechRepublic)

“This
network
seems
to
be
targeting
existing
cryptocurrency
investors
with
low-quality
videos
in
different
languages
without
localizing
them
to
reach
different
regions,
so
I’d
say
it’s
a
pretty
opportunistic
approach,”
said
WithSecure
Intelligence
Researcher
Andy
Patel.
“Typically,
this
results
in
a
large
volume
of
small
transactions.

“But
as
that
volume
increases,
so
do
the
odds
of
them
getting
lucky
and
finding
someone
able
and
willing
to
invest
more
substantial
amounts.”
(Figure
B)

Figure
B

He
said
the
darker
picture,
the
scams’
relative
unprofitability
notwithstanding,
is
that
the
scammers
have
gamed
YouTube’s
recommendation
algorithms
and
that
description
fields
attached
to
the
videos
also
employ
a
unique
style
of
SEO
designed
to
game
YouTube’s
search
functionality.

“Moderating
social
media
content
is
a
huge
challenge
for
platforms,
but
the
successful
amplification
of
this
content
using
pretty
simple,
well-known
techniques
makes
me
think
that
more
could
be
done
to
protect
people
from
these
scams,”
Patel
said
in
the
report
(Figure
C).

Figure
C

FTC:
Crypto
scams
posted
small
numbers
but
lucrative
in
aggregate

In
a
June
2022
note,
the
U.S.
Federal
Trade
Commission
said
that

crypto
is
proving
a
lucrative
scam
channel,
with
more
than
46,000
people
reportedly
having
lost
a
total
of
over
$1
billion
in
crypto
to
scams
since
2021.

The
note
said
cryptocurrency
was
identified
as
the
payment
method
for
24%
of
reported
dollar
losses
in
fraud
reports
to
the
FTC,
and
that
the
median
individual
reported
loss
was
$2,600.
The
top
cryptocurrencies
that
people
reported
using
to
pay
scammers
were
Bitcoin
(70%),
Tether
(10%)
and
Ether
(9%).

Crypto
scams
to
watch
for
in
2023

Financial
software
firm
Abrigo,
in
a

2023
report,
reiterated
FTC
warnings
about
an
additional
nine
crypto
scams
that
institutions
and
individuals
should
watch
for
this
year:

• 
  Romance
  scams:
  Preying
  on
  relationships
  and
  can
  have
  both
  an
  investment
  and
  payment
  angle.
  In
  a
  recent
  
  note,
  the
  FTC
  reported
  that
  last
  year
  nearly
  70,000
  people
  reported
  a
  romance
  scam,
  and
  reported
  losses
  hit
  $1.3
  billion,
  with
  a
  median
  loss
  of
  $4,400.
• 
  Business,
  government
  or
  job
  impersonation
  scams:
  Threat
  actors
  present
  themselves
  as
  trustworthy
  online
  sources
  and
  convince
  users
  to
  send
  them
  funds
  by
  buying
  
  crypto.
• 
  Rug
  pull
  scams:
  Investment
  scammers
  propose
  a
  new
  crypto
  opportunity
  or
  NFT
  that
  requires
  funding.
• 
  Phishing
  scams:
  Emails
  (or
  “smishing”
  text
  messages)
  carry
  malicious
  links
  that
  gather
  details
  like
  a
  user’s
  
  crypto
  wallet
  and
  other
  key
  information
  allowing
  access
  to
  the
  victim’s
  crypto.
• 
  Social
  media
  scams:
  These
  begin
  with
  an
  ad,
  post
  or
  message
  on
  social
  media,
  particularly
  Instagram,
  Facebook,
  WhatsApp
  and
  Telegram.
• 
  Ponzi
  schemes:
  Scammers
  collect
  funds
  from
  new
  investors
  via
  
  cryptocurrencies.
• 
  Upgrade
  scams:
  Consumers,
  accustomed
  to
  upgrades,
  can
  easily
  be
  scammed
  into
  giving
  up
  their
  
  private
  keys
  as
  part
  of
  an
  “upgrade.”
• 
  SIM-Swap
  scams:
  Theft
  of
  a
  cell
  phone’s
  SIM
  card
  can
  allow
  access
  via
  DFA
  to
  the
  victim’s
  crypto
  wallets.
• 
  Fake
  crypto
  exchanges
  and
  crypto
  wallets:
  Inexperienced
  crypto
  users
  may
  be
  lured
  into
  investing
  in
  a
  new
  high-value
  cryptocurrency
  exchange
  opportunity
  or
  a
  “cheap”
  Bitcoin
  that
  doesn’t
  exist.

Patel
of
WithSecure
told
TechRepublic
that
while
there
are
no
obvious
business
implications
that
relate
to
this
particular
scam,
“both
individuals
and
businesses
should
always
be
wary
of
investment
schemes
that
look
too
good
to
be
true.
This
is
especially
the
case
when
considering
anything
related
to
crypto
currencies.”

Blockchain,
for
better
or
worse,
is
here
to
stay.
If
you
are
interested
in
learning
more
about
the
fundamentals
of
the
technology
behind
cryptocurrency,
check
out
these

blockchain
development
fundamentals.