New YouTube Windows Attack Warning—Three Strikes And You’re Hacked

Forbes - Mar 9th, 2025
Open on Forbes

A new malware campaign targets YouTube users by exploiting the platform's copyright strike system. Researchers at Kaspersky have identified attackers using fake copyright claims to pressure YouTube creators into sharing malicious links. These links, disguised as tools to bypass content access restrictions, actually download cryptomining malware onto victims' systems. The campaign has affected numerous users, with one YouTuber's video alone receiving over 400,000 views before the malicious link was removed.

This development highlights the sophistication and opportunistic nature of modern cyber threats, as attackers leverage trusted platforms like YouTube to reach potential victims. The campaign's use of YouTube's copyright system, combined with the lure of bypassing restrictions, underscores the importance of vigilance among content creators and viewers. While this campaign primarily distributed cryptomining malware, experts warn that similar tactics could be used for more complex attacks in the future. Users are advised to avoid downloading software from video descriptions to protect themselves from such threats.

Story submitted by Fairstory

RATING

7.2
Fair Story
Consider it well-founded

The article provides a detailed and timely examination of a malware campaign targeting YouTube users, leveraging copyright strike warnings. It is underpinned by credible sources, primarily from Kaspersky, a well-regarded cybersecurity firm. The story effectively raises public awareness about cybersecurity risks associated with downloading software from unverified sources on YouTube. However, it could benefit from a broader range of perspectives, including input from YouTube and affected users, to provide a more balanced view. Additionally, while the technical content is generally clear, further simplification of complex concepts could enhance accessibility for a general audience. Overall, the article is informative and relevant, with the potential to influence public behavior and drive discussions in the cybersecurity community.

RATING DETAILS

8
Accuracy

The story provides a detailed account of a malware campaign targeting YouTube users through copyright strike warnings. The claim that attackers are using YouTube's copyright system to distribute cryptomining malware is supported by specific examples, such as a YouTuber with 60,000 subscribers being involved. The mention of Kaspersky researchers, including Leonid Bezvershenko, adds credibility, as Kaspersky is a well-known cybersecurity firm. However, the story would benefit from additional corroboration from YouTube or other independent security experts to verify these claims further. The potential for more complex attacks, as suggested by Bezvershenko, is a speculative but reasonable concern based on the described tactics.

7
Balance

The article primarily presents the perspective of cybersecurity researchers from Kaspersky, focusing on the technical aspects of the malware campaign. While this provides a detailed insight into the attack methods, the story lacks perspectives from other stakeholders, such as YouTube or affected users. Including comments from YouTube could have provided a more balanced view of how the platform is addressing such threats. The absence of input from victims or other cybersecurity firms limits the scope of perspectives, potentially skewing the narrative towards Kaspersky's findings.

7
Clarity

The article is generally clear in its language and structure, outlining the key elements of the malware campaign and its implications. However, some technical aspects, such as the use of Windows Packet Divert drivers, could be explained more clearly for a non-expert audience. The narrative could benefit from a more straightforward explanation of technical terms and processes to ensure broader comprehension. Overall, the article maintains a neutral tone, avoiding sensationalism.

8
Source quality

The article relies heavily on information from Kaspersky, a reputable source in the cybersecurity industry. The involvement of named researchers, such as Leonid Bezvershenko, adds to the credibility. However, the story would be strengthened by including additional sources or corroborating evidence from other cybersecurity experts or organizations. The reliance on a single source, while credible, may limit the depth of the analysis and the ability to confirm the broader implications of the campaign.

6
Transparency

The article is transparent about its primary source, Kaspersky, and provides specific names of researchers involved. However, it lacks detailed information on how the data was collected or the methodology used in the research. There is also no discussion of potential conflicts of interest, such as Kaspersky's commercial interests in cybersecurity solutions. Greater transparency in these areas would enhance the reader's understanding of the basis for the claims and any potential biases.

Sources

  1. https://www.cybereason.com/blog/from-cracked-to-hacked-malware-spread-via-youtube-videos
  2. https://beamstart.com/news/new-youtube-windows-attack-warningthree-1741521725
  3. https://www.youtube.com/watch?v=L4zmvUrtP3U
  4. https://www.youtube.com/watch?v=2N3sGvowDjE
  5. https://www.youtube.com/watch?v=alA1CGTephQ