Cyber security company Kaspersky: Hackers blackmailed YouTube bloggers to promote crypto mining Trojan

On March 12, cyber security firm Kaspersky found that hackers used copyright complaints to threaten YouTube content creators, forcing them to add crypto mining Trojan SilentCryptoMiner to the video description. The malicious software is based on XMRig and is used to mine cryptocurrencies such as Ethereum, Ethereum Classic, Monero, Ravencoin, and control botnets through the Bitcoin blockchain.
The main target of the hackers was the YouTuber who provided the installation tutorial of the Windows Packet Divert driver. They first filed a false copyright complaint against the video, and then contacted the creator claiming to be the developer of the driver and asked him to add a malicious link. One YouTuber who 60,000 fans is known to have been victimized, causing more than 40,000 people to download the infected file. Kaspersky estimates that at least 2,000 devices have been infected.
Leonid Bezvershenko, a security researcher at Kaspersky, warned that hackers were exploiting the trust between YouTubers and their viewers, and that such threats could spread to platforms such as Telegram. He advised users not to trust tutorials asking them to shut down antivirus software and to verify the origin of any files before downloading them to prevent infecting crypto-mining Trojans.