Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Fake YouTube site targeted Syrian activists, digital watchdog EFF says

The site tried to install malicious software disguised as an update for Adobe's Flash application

Article comments

A fake YouTube site purporting to show videos supporting the opposition in Syria has been taken down after it tried to infect visitors with malicious software, according to digital watchdog Electronic Frontier Foundation (EFF).

The EFF is "deeply concerned about this pattern of pro-government malware targeting online activists in authoritarian regimes," wrote Eva Galperin and Morgan Marquis-Boire.

Syria, which has been sternly criticised for its brutal treatment of anti-government protestors since an uprising began about a year ago, is known to heavily censor the internet and monitor users.

The fraudulent YouTube page tried to get users to enter their username and password, which in some cases is linked with a person's Gmail account. The site also tried to get the victim to download a bogus update for Adobe Flash, which was actually Windows malware, the EFF wrote.

The malware then "connects back to an address in Syrian IP space and downloads additional malware, which gives the attacker administrative access to your computer," the EFF wrote.

The EFF detailed how a user can tell if he has been infected. The organisation recommended reinstalling the operating system if the computer has been infected, since an attacker could have installed other kinds of malware on the machine as well. The EFF said all passwords should also be changed for services accessed while the machine was infected.

Last week, the EFF blogged about a remote access tool called "XTreme RAT," which was spreading through email and chat programs. The malware could take screenshots and log keystrokes on a victim's computer, sending the data to a Syrian IP address.

The organisation also noted another remote access tool, Darkcomet RAT, which was reportedly infecting the computers of Syrian activists a few weeks before. That tool could disable antivirus programs, record keystrokes and steal passwords, also sending the data to the same IP address in Syria as "XTreme RAT," the EFF explained.


More from Techworld

More relevant IT news


Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *