Beware of malicious components hidden behind fake YouTube videos

Feb 16, 2012 10:43 GMT  ·  By

A day after Whitney Houston’s death was made public, cybercriminals began launching malicious campaigns designed to dupe unsuspecting fans into handing over sensitive information, or clicking on links that would earn the crooks money from affiliate marketing sites.

Sophos came across another one of these scams, this time promising a video from Whitney Houston’s autopsy that allegedly reveals a shocking secret.

The scam that’s currently making rounds on Facebook looks something like this:

[video] - Whitney Houstons autopsy reveals a shocking secret that explains her death. [LINK] Breaking News: Coroners autopsy reports reveals a dark past and secret life which tragically led to Whitney Houstons death. Once the link is clicked, the user is taken to a fake Facebook webpage that displays a YouTube video window. As in many similar cases, in order for the video to be played, the victim must install a YouTube Player.

This so-called YouTube Player is actually a malicious file that can represent anything from a rogue browser extension to a Trojan that’s created to steal sensitive information from the devices it infects.

There are many situations where Internet users are requested to install codecs and updates and, basically, there are two ways to handle such scenarios.

If the name of the update sounds legitimate, for instance if you’re asked to install a Flash Player update, then you must head to the vendor’s site, or another trusted website, and acquire the update.

If the name of the update is suspicious, such as this YouTube player, it’s a clear indication that you’re presented with a plot.

In any of these cases, never install the required component directly from the website that so generously offers it.

Finally, if instead of the much-promised video you’re faced with a survey page, it’s another telltale sign that everything is just another scam.