Despite the channel’s legitimate appearance—including repurposed content from TradingView—the unlisted tutorial video instructs viewers to activate a fictitious “AI-powered developer mode” that purportedly predicts cryptocurrency market trends with 97% accuracy. A new wave of “Scam-Yourself” attacks leveraging AI-generated deepfake videos and malicious scripts is targeting cryptocurrency enthusiasts and financial traders, marking a dangerous evolution in social engineering tactics. Crucially, the deepfake video hide its artificial nature through procedural details—a synthetic voice explains how to bypass Windows Defender by adding registry exclusions, while on-screen keystrokes mirror authentic TradingView workflows. The video features a synthetic persona named “Thomas Harris” or “Thomas Roberts,” created using advanced facial animation, voice synthesis, and body movement replication. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. While the security analysts noted that the operation begins with a deepfake video hosted on a compromised YouTube channel boasting 110,000 subscribers. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With cybercriminals now automating persona creation and script refinement, verifying digital instructions through multiple channels has become a non-negotiable security practice. Discovered by cybersecurity researchers at Gen Digital, this campaign exploits verified YouTube channels, synthetic personas, and AI-crafted payloads to manipulate victims into compromising their own systems. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The attacks—which saw a 614% surge in Q3/2024—combine cutting-edge deepfake technology with psychologically tailored lures, raising urgent concerns about the weaponization of generative AI in cybercrime. This script connects to a command-and-control (C&C) server—recently tracked as developer-update[.]dev or developerbeta[.]dev—to deploy Lumma Stealer or NetSupport Remote Access Tool (Figure 2). Attackers further amplify reach through YouTube’s sponsored ad system, targeting users watching legitimate financial content.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Feb 2025 10:25:17 +0000