{"id":885,"date":"2024-01-16T14:48:45","date_gmt":"2024-01-16T14:48:45","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/kako-se-pomocu-youtube-a-sire-malveri\/"},"modified":"2026-11-04T08:54:49","modified_gmt":"2026-11-04T08:54:49","slug":"kako-se-pomocu-youtube-a-sire-malveri","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/upozorenja\/kako-se-pomocu-youtube-a-sire-malveri\/","title":{"rendered":"Kako se pomo\u0107u YouTube-a \u0161ire malveri"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>Otkriveno je da zlonamjerna grupa aktera koristi YouTube za \u0161irenje Lumma Stealer malvera. <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Putem YouTube videa reklamiraju \u201ekrekirane\u201c ina\u010dice aplikacija i vode \u017ertve kroz proces instalacije<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Napada\u010di koriste skra\u0107ene poveznice, naj\u010de\u0161\u0107e pomo\u0107u TynURL i Cuttly servisa koje pokre\u0107u preuzimanje .NET datoteke za dohvat Lumma Stealer malvera.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Vektor napada \u2013 YouTube<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Najprije akter preuzme kontrolu nad ne\u010dijim YouTube ra\u010dunom te objavi video u kojem obja\u0161njava preuzimanje krekirane verzije odre\u0111ene aplikacije \u2013 nude mogu\u0107nost besplatnog kori\u0161tenja programa koji se ina\u010de pla\u0107a. &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">U opisu videa se nalazi poveznica koja pokre\u0107e preuzimanje ZIP datoteke sa skrivenim zlonamjernim k\u00f4dom koji slu\u017ei za kasniju fazu napada.\u00a0 ZIP datoteka sadr\u017ei \u201einstaller\u201c koji pokre\u0107e preuzimanje Lumma Stalera.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a08a29192&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a08a29192\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2024\/01\/fig03-lumma-hacked-youtube-channel.png\" alt=\"\" class=\"wp-image-111487\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Slika: YouTube kanal koji reklamira besplatnu verziju Sony Vega pro 20 programa (Izvor: fortinet.com)<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Lumma stealer je vrsta zlonamjernog softvera koji mo\u017ee ukrasti osjetljive podatke s ra\u010dunala. Krade podatke o sustavu, povijest pretra\u017eivanja, podatke o kripto nov\u010danicima i podatke o dodacima u pregledniku. Napisan je u C programskom jeziku i prodaje se na forumima Dark weba. Kako bi izbjegao detekciju, koristi se razli\u010ditim tehnikama obfuskacije. Tako napada\u010di preusmjeravaju standardni tok procesa, a sam proces ne otvara nove prozore kako ga \u017ertva ne bi primijetila.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Detalje o ovoj vrsti napada mo\u017eete pro\u010ditati <a href=\"https:\/\/www.fortinet.com\/blog\/threat-research\/lumma-variant-on-youtube\" target=\"_blank\" rel=\"noreferrer noopener\">OVDJE<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>Otkriveno je da zlonamjerna grupa aktera koristi YouTube za \u0161irenje Lumma Stealer malvera. Putem YouTube videa reklamiraju \u201ekrekirane\u201c ina\u010dice aplikacija i vode \u017ertve kroz proces instalacije. Napada\u010di koriste skra\u0107ene poveznice, naj\u010de\u0161\u0107e pomo\u0107u TynURL i Cuttly servisa koje pokre\u0107u preuzimanje .NET datoteke za dohvat Lumma Stealer malvera. Vektor napada \u2013 YouTube Najprije akter preuzme kontrolu nad [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1415,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[23],"tags":[],"tema":[],"class_list":["post-885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-upozorenja"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=885"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/885\/revisions"}],"predecessor-version":[{"id":1418,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/885\/revisions\/1418"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1415"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=885"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=885"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}