Key highlights
- NCC warned that those that acquire pirated software and resources risk becoming victims of cybercriminals that use AI-generated YouTube videos to distribute malware.
- This could lead to critical damage like data theft, financial loss, identity theft, system damage and reputation damage.
- To avoid becoming a victim, telecom consumers should avoid downloading pirated software because they are generally harmful and illegal, as well as install antivirus software with internet security.
The Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) has warned those looking to acquire pirated software and resources that they risk becoming victims of cybercriminal gangs that are using AI-generated YouTube videos to distribute malware.
The commission further warned in its advisory that the consequences of falling victim can be significant for individuals and organisations, resulting in critical damage like data theft, financial loss, identity theft, system damage and reputation damage.
This disclosure is contained in a statement issued by NCC’s Director of Public Affairs, Dr. Reuben Muoka, on Sunday in Abuja, where he noted that unsuspecting victims who watch these AI-generated tutorial videos will be duped into clicking on one of the links in the video description.
The number of YouTube videos with such links increased by 300%
- Muoka said, “Unsuspecting victims who watch these AI-generated tutorial videos will be duped into clicking on one of the links in the video description.
- “It usually results in the download of data-stealing malware.
- “The number of YouTube videos containing such links had increased by 200-300 percent month-on-month since November 2022.’’
How it stimulates the interest of victims
The NCC Spokesman added,
- “To stimulate the interest of potential victims, video tutorials on how to pirate sought-after software such as AutoCAD, Adobe Photoshop, Adobe Premiere Pro, and other similar paid-for software are created. These videos are created with AI and feature humans with facial features that research has shown other humans find trustworthy.
- “The tutorials in these videos are frequently bogus and steer viewers to links in the description that led to information-stealing malware like Raccoon, Vidar, and RedLine.’’
He said malicious actors can create AI-generated videos that include hidden or disguised malware. Mouka said these videos may appear to be harmless or even entertaining, but they can contain malicious code that can infect a viewer’s device when the video was downloaded or played.
AI-generated videos used to trick viewers into downloading malware
Muoka pointed out that cybercriminal actors can also use AI-generated videos to trick viewers into downloading malware.
- He said, “For example, they can create a video that appears to be a legitimate software update or security patch, but it contains malware that infects the viewer’s device. They equally use AI-generated videos to distribute phishing scams.
- “They can create a video that appears to be from a legitimate company or organisation and prompts viewers to click on a link to enter their login credentials or personal information. Once the viewer clicks on the link, they are directed to a fake website that steals their information.
- “Additionally, malicious actors can use AI-generated videos to distribute ransomware. They can create a video that appears to be harmless, but when the viewer clicks on a link or downloads a file associated with the video, their device becomes infected with ransomware that locks them out of their files and demands payment to regain access.’’
How to avoid being a victim
- He added, “To avoid becoming a victim, telecom consumers should avoid downloading pirated software because they are generally harmful and illegal.”
He said that the advisory recommended the installation of antivirus software with internet security.
Mouka advised the public to keep up to date by installing an endpoint detection and response (EDR) solution that was comprehensive and thinking before clicking any link.
