​IT security specialists Bitdefender have noticed an increase in “streamjacking” attacks carried out through YouTube, a scam that clones official accounts or takes over existing ones. Hackers have started using deepfake technology to create fake videos of famous people in the field of cryptocurrencies.

Unlike the campaign discovered in October 2023, cybercriminals have refined their attack methods to target as many users as possible.

In addition to cloning official accounts of public figures such as Elon Musk, criminals are also using the popularity of cryptocurrency events to launch new scams. According to research, hackers have started using deepfake technologies to create fake videos of famous people in the cryptocurrency industry, which lend more credibility to scam attempts.

One such scam was directed against the image of MicroStrategy and its founder Michael Saylor. He appears in a series of deepfake clips where he challenges the online community to find a QR code, scan it, and then send the amount of cryptocurrency to be doubled. Hacked channels use variants of the official MicroStrategy logo.

Some of these deep fake videos are made in good quality and can fool the less trained eye. To prevent victims from finding out about their scams, the attackers disable the live chat section of the channel, except for members who have a special status or have been subscribers for a long time.

In the course of the investigation, the hackers compromised a significant number of channels with very large subscribers – some with over a million subscribers, the largest with 12.5 million – indicating that these attacks have grown to a significant scale.

Once attackers gain control of a YouTube account, they make several changes to make it appear to viewers that the channel belongs to the entity they are cloning:

changing the name of the channel

restrict access to videos that have been made private to hide previous content

changing channel images to reflect the new identity

modify or remove channel descriptions, links and any other sources that may lead to the identification of the original channel.

According to the analysis carried out by Bitdefender specialists, the potential earnings of attackers range from $528,200 to $600,500, depending on the quotation of cryptocurrencies.

Recommendations for subscribers of the YouTube channel:

Be wary of videos with titles that encourage you to invest in cryptocurrencies or promise big profits.

Never scan QR codes you see in videos advertising free cryptocurrency gifts.

Report scams you see and stay up to date with the latest scam campaigns.

Be careful with the names of the channels you watch – if they contain unusual characters or typos, the channel is most likely fake.

Photo source: Dreamstime.com