YouTube Downloader Sites Are Now Hiding Proxyware to Hijack Your Bandwidth
ID: 090660f4-c6f2-5645-bb7e-303adcbf419e
STIX ID: report--090660f4-c6f2-5645-bb7e-303adcbf419e
Feed Name: securityonline.info
Threat Score
Cybercriminals are distributing Proxyware malware via fraudulent YouTube video downloader sites: victims download an installer (disguised as WinMemoryCleaner/CleanZiloApp) that uses PowerShell to install NodeJS and malicious JavaScript, persists via Task Scheduler, communicates with a C2 server, and ultimately installs Proxyware (previously DigitalPulse/Honeygain, now Infatica), stealing victims' network bandwidth; ASEC research highlights sandbox evasion and GitHub-hosted samples.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.