From Cracks to Crooks: YouTube as a Vector for Malware Distribution

TL;DR

This paper investigates how cybercriminals exploit YouTube for malware distribution, highlighting deceptive campaigns, evasion techniques using multilingual metadata, and the increasing use of such methods to bypass detection.

Contribution

It introduces a novel evasion technique leveraging YouTube's multilingual metadata to evade automated malware detection systems.

Findings

Evasion technique is increasingly used in malicious videos

Multilingual metadata helps malware bypass detection

Cybercriminal campaigns exploit YouTube's trustworthiness

Abstract

With billions of users and an immense volume of daily uploads, YouTube has become an attractive target for cybercriminals aiming to leverage its vast audience. The platform's openness and trustworthiness provide an ideal environment for deceptive campaigns that can operate under the radar of conventional security tools. This paper explores how cybercriminals exploit YouTube to disseminate malware, focusing on campaigns that promote free software or game cheats. It discusses deceptive video demonstrations and the techniques behind malware delivery. Additionally, the paper presents a new evasion technique that abuses YouTube's multilingual metadata capabilities to circumvent automated detection systems. Findings indicate that this method is increasingly being used in recent malicious videos to avoid detection and removal.