Fake OBS Studio Hack Targeting YouTubers

🔥 YOUTUBE ALGORITHM ➡ Like, Comment, & Subscribe!

[StrokeMahEgo]

A few minor points:
1. The S in OBS stands for Software.
2. Always ignore all "ad" results on Google.
3. Always scroll down to actual search results.
4. Report ads that are sketchy.

[DiamondSaberYT]

Actually it’s a big issue. Yesterday I was helping my family member install OBS, and as they googled OBS, the fake advertisements have occupied the whole view. We had scroll through at least 3 fake ads before we got the actual obsproject website.
Google should definitely make a human ad verification, or improve their algorithms so they’d first scan the website before promoting it.

[aprilnya]

this is why people should have adblock. not just to not see ads but also for security. so many ads are scams or malware or that kinda stuff

[grunner]

If Google is pushing these kinds of ads, I feel like that should be ground for a class action lawsuit.

[NoodlyPanda]

I remember one time Forbes ran an article about how ads were spreading malware, but insisted you turn off your adblocker to read the page/article only for their ads to also infect your computer with malware xD And some people wonder why adblock is required to viewing the web.

[stickinug]

Thank you for the PSA! Everyone should report fake ads every time they see them. Click the 3 dots next to the result to report.

[kristiannanista]

Man we're going to need verified checkmarks on websites now 💀

[TheMAZZTer]

It's worth noting malware authors will absolutely take steps to ensure the common AVs don't detect their stuff (they can run scans all day and tweak their malware until it's not detected) so it's not surprising Windows Defender didn't detect it. (You did go into it a bit with the mention of file padding, )

All the extra files in the ZIP could be part of this attempt, though I'm not sure how it would affect things. Or it could be an attempt to randomize the hash of the file for whatever reason .

[THREKINGZStudioskz]

We needed this video… Beginners who wants to start streaming on Twitch needs to be aware.

[CybersFutures]

I have to say I have loved this channel for a while and their is always something new to explore, keep up the great work. And please do more malware analysis

[boogieman]

The dots are represented as null bytes which means it is already utf16-le encoded since it is for Windows. Decoding to utf8 will remove the null bytes

[IamKyuTee]

This is why Google should investigate each ad and not let ads be visible to the public but visible to the advertiser as if it is while they check it. Also making sure they have tge actual purchaser by having a video chat with them holding up their picture ID and the registered business license in the country it is registered. It would stop a lot of this crap with that done. Also their ID address and the location of their ip address being at least same city and country.

[muB]

I am still surprised how Discord always chose to stay with profit after so many warnings from the industry saying they should block their CDN access from unauthorized connections to prevent payload hosting.

[emocatte]

This isnt the only thing. This happened wth MSI a few weeks ago. Google ad was promoting a fake MSI afterburner that I actually ended up falling for- and it was promoting THREE of them. The top 3 links were all slightly different websites but absolute 1:1 clone with the actual one.

[AwkwardTruths]

Youtube has gotten worse in vetting their advertisers. I've reported the same ad (an ad claiming that a fruit will 'kill' diabetes) numerous times and I still see it AND it's the same advertiser.

[yspegel]

This problem is as old as internet its self, never search for the word "download". This always was a major problem with getting drivers. Search for the brand you need, then search for support/download once you are sure you're on the official page.

[meistroldcontent]

Those random files in the about folder are used to change the hash of the zip folder. Since those files can be anything, the web server can dynamically change the hash of the zip folder every time by editing the binary data of the zip file.

[shuttlecrab]

Jeezos, the bots be botting in these comments, damn!

Great video, John. Keep up the great work

[xenogaming]

Google has been doing things like this for years. Not just OBS, but anything you type in with an AD slap next to it. Sometimes comes out as a scam, so don't be surprised that you're dealing with a scammer problem.

[majoryoshi]

if winget became remotely more common then this would be a complete nonissue.