A Dangerous Crypto Scam is Targeting YouTubers

Yesterday, a pretty blatant #crypto #scam reached out to me via Discord to coordinate a promotional video. Obviously, I would never do a promotional video for a crypto game, so I decided to have a little bit of fun with them. However, what I uncovered was instead a very sophisticated and scary piece of malware.

I decided to perform a little bit of malware analysis on this and break their scam down to help raise awareness. While a scam like this may seem obvious if you have a strong technical background, this specific example was much more convincing than some of the others I've seen in the past.

They asked for a promotional video, I delivered!

Thanks for watching!

Subscribe:
Buy me a Coffee:
Follow me on Twitter:
Join our Discord!:

[asteroidrules]

I guess it makes sense that crypto scammers didn't think to hide from people inspecting elements on their site, they know cryptobros can't right click.

[hayberdasher]

"Oh you're getting a virus alert from our software? Try disabling the anitvirus, that should get rid of the alert."

[annieshavingthoughtsagain]

Wow, a scam that pretends to be a different scam. It's scamception!

[jf]

Reminds me of that GameStop NFT creator who made tons of sloth NFTs. They opened some malicious file to "collab" with someone, and ended up losing his seed phrase. This resulted in all the existing NFTs that had been sold to become worthless because the scammer had control of the wallet and could theoretically create more NFTs (although he just stole his money). Then the Sloth had to re-mint every single NFT with a new wallet and send the NEW, REAL nft to the old holders

[cicadaseance]

I have an Aunt Nancy, and it's good to finally know she isn't real. Thanks, Jauwn

[michaeltylerstewart]

Not only was this entertaining, this was also educational.

[pantallahueso]

8:15 It's also worth noting that a stealer malware can also steal your cookies, which allows them to bypass your 2FA because they don't need to actually sign in.

[pyroman]

Amazing quality breakdown, as a cyber security person I love to see advanced topics broken down into human basic English for those less tech literate. I wish I had the production skills you have to be able to help build this bridge of awareness and avoidance for vulnerable people. Keep up the spectacular work

[blankityblankblank]

I'm not in cyber security but seeing the breakdown of the virus, what it does on a virtual machine, and everything else was very educational. Much better than repeating "don't download weird things" again and again. You did a good job.

[_crowfisher]

i think this is the video where I realized this guy knew way more than I thought he did about tech stuff

[Ariamaki]

My favorite goof-up in their chain of stupid steps here was the 760M file magically coming out of a 26M zip along with several other directories "worth" of files. That implies the data was trivially compressed (IE, like you said mostly 0 bits) or self-springing, because there's no way in the nine hells an actual proper program, not even a launcher, scrunched that effectively.

[Axcille]

"there are no real people with the name nancy" -got me laughing

[medea]

Great video! 👍 Just wanted to point out @ 10:32 that reporting these scams is _very important, _ even if no-one responds to your specific complaint. You might not notice any immediate action being taken, but that doesn’t mean the report doesn’t achieve anything. Scammers rely on people's reluctance to report, knowing it's not feasible for cybersecurity teams & law enforcement to investigate small numbers of incidents… so reporting “near-misses” or attempts like this one always provides valuable info while helping the issue reach critical mass to prompt action by authorities.

“Near-miss” data is also incredibly valuable for big-picture analytics & being proactive with security, _especially_ when there’s a significant social engineering element to it. If I get a scam text or email for a company I’m a customer of, I always report it to them because I know how useful that info is from the other side of the equation. Cybersecurity whack-a-mole is much easier to play if you can work out which hole they’re likely to pop out of next!

[drdiabeetus]

Hey! You forgot about the other places that style of ASCII art appears. Old all-text game walkthroughs and mod readmes.

[bwarrent]

I bet they stole the assets of an old failed crowdfunding game to make theirs look legit.

[esuelle]

Great work, Jauwn. Their website and art actually look quite decent which is surprising. Still, the scam falls apart if you look closer. Or if you're not in the habit of downloading and running shady NFT games from the web. I guess that's an occupational hazard for you now. 🧐

[faawks]

Mate, I like to think I'm pretty up to date with all the scams going on, but this was mostly new to me, I firmly believe that EVERYONE should watch this video, super informative, I hope it can somehow go viral, I'll do my part.

[ZeroPlayerGame]

One thing you didn't mention but is a HUGE red flag is a password-protected archive next to a password in a text file. The only reason I've ever seen that done is so that your antivirus cannot snipe the file dead as you're downloading it, as it has no way to decrypt the archive and access the contents.
You ever see a password-protected archive like this, it should go directly to trash, no matter what it claims to be.

[thatmspaintgirl]

1:16 These are SUSPICIOUSLY similar numbers. You'd expect them to have closer to 16, 000 Twitter followers if they have that many people on their Discord. It's a much less high-commitment action, so you'll automatically get more traction on that platform. Them being the same implies bots purchased in equal amounts for each Social Media Platform they're engaging on.

[SHDW-nfki]

Fun fact, Magical World is a D&D slang term for a campaign or setting that revolves around the DM's sexual fetish(es)