logo

Malware Distribution Using Fake YouTube Pages

ID: 28193e04-93b1-5ca2-8590-599ed5350450

STIX ID: report--28193e04-93b1-5ca2-8590-599ed5350450

Feed Name: Zscaler Security Research Blog

Threat Score
50/100

Date Published: 2025-04-02

Date Updated: 2026-05-01

...
...

A fake YouTube webpage hosts a Java applet and VBScript that prompt visitors to run a Java applet (YouTube.jar) which subsequently downloads and executes malicious binaries (ser.exe, serv.exe, saved as update.exe). The report includes screenshots and source snippets, file hashes/links, and warns the site is not blocked by Google Safe Browsing despite partial antivirus detection, emphasizing a successful social‑engineering distribution method.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.