Phishing youtube channels and links are stealing credentials


Recently, cybercriminals launched a phishing attack using fake YouTube links to steal user login credentials. These links were cleverly disguised to look legitimate and used redirections through multiple websites to hide their true destination. The attack exploited a tool called the “Tycoon 2FA phishing kit,” making it capable of targeting a large number of users and even bypassing two-factor authentication (2FA). This highlights the growing sophistication of phishing campaigns and the need for extra caution while interacting with link.

How it works

  • Attackers created fake links that look like they are from YouTube. For example, the link might start with something like “hxxp[://]youtube” (instead of the usual “https://youtube”), making it seem real but hiding its true purpose.
  • When someone clicks these fake links, they are secretly redirected through multiple websites before reaching the final fake page. This makes it harder for security systems to detect the phishing attempt.
  • The final page looks like a legitimate login page, but when users enter their credentials, the attackers steal them.
  • According to researchers, this specific campaign was likely conducted by a hacking group called Storm1747. They used a tool called “Tycoon 2FA phishing kit,” which is designed for large-scale attacks and can even bypass two-factor authentication.

How to protect

  • Verify Links Before Clicking: Always check if a link is legitimate by hovering over it to see the full URL. Avoid clicking on suspicious or shortened links.
  • Enable 2FA: Use two-factor authentication for all accounts, but be cautious of phishing attempts designed to bypass it.
  • Use Antivirus and Anti-Phishing Tools: Install security software that can detect and block phishing sites.
  • Educate Yourself and Others: Stay informed about the latest phishing tactics and share this knowledge with family and colleagues.
  • Report Suspicious Activity: If you encounter a fake link or phishing attempt, report it to the website or service it claims to represent.