{"id":209214,"date":"2025-02-25T12:59:48","date_gmt":"2025-02-25T20:59:48","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=209214"},"modified":"2025-02-25T12:59:48","modified_gmt":"2025-02-25T20:59:48","slug":"the-dark-side-of-clickbait-how-fake-video-links-deliver-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/the-dark-side-of-clickbait-how-fake-video-links-deliver-malware\/","title":{"rendered":"The Dark Side of Clickbait: How Fake Video Links Deliver Malware"},"content":{"rendered":"

Authored By\u202fSakshi\u202fJaiswal<\/span><\/span>\u00a0<\/span><\/strong><\/em><\/p>\n

McAfee Labs recently observed a surge in phishing campaigns that use fake viral video links to trick users into downloading malware. The attack relies on social engineering, redirecting victims through multiple malicious websites before delivering the payload. Users are enticed with promises of exclusive content, ultimately leading them to fraudulent pages and deceptive download links.\u00a0<\/span>\u00a0<\/span><\/p>\n

\"\"\u00a0<\/span><\/p>\n

Figure 1: Geo Heatmap showing McAfee customer encounters over the past 3 weeks.<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

 <\/p>\n

Analysis<\/span>\u00a0<\/span><\/h2>\n

1. Upon executing the PDF file, the displayed page appears to be part of a phishing scam leveraging clickbait about a “viral video” to lure users into clicking suspicious links. The document contains blue hyperlinked text labeled as “Watch <\/span>\u27a4<\/span> Click Here To Link (Full Viral Video Link)” and a deceptive video player graphic, giving the illusion of a playable video.<\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

Figure 2: PDF Image<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

2. The user clicks on “<\/span>Watch <\/span><\/b>\u27a4<\/span><\/b> Click Here To Link (Full Viral Video Link)<\/span><\/b>“, which redirects them to a webpage (gitb.org) displaying fake “viral video leaked” content, excessive ads, and fake notifications to lure users. It promotes adult content, gambling, and misleading download buttons, which are common indicators of phishing or malware traps.<\/span>\u00a0<\/span><\/p>\n

\"\"<\/span><\/p>\n

Figure 3: Redirected Webpage<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

3. This further redirects to malicious URL \u201c<\/span>hxxps[:]\/\/purecopperapp.monster\/indexind.php?flow_id=107&aff_click_id=D-21356743-1737975550-34G123G137G124-AITLS2195&keyword=Yourfile&ip=115.118.240.109&sub=22697121&source=157764\u201d<\/span><\/b>\u00a0<\/span><\/p>\n

\"\"<\/span><\/p>\n

Figure 4: Redirected Webpage2<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

4. And then redirected to below URL: <\/span>\u201chxxps[:]\/\/savetitaniumapp.monster\/?t=d6ebff4d554677320244f60589926b97\u201d <\/span><\/b>which presents a password-protected download link hosted on Mega.nz, requiring the user to manually copy and paste the URL.<\/span>\u00a0<\/span><\/p>\n

\"\"<\/span><\/p>\n

Figure 5: Redirected Webpage with download link<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

5. Upon checking the URL, it displays a loading screen while preparing the malicious file for download and then shows a downloadable file named 91.78.127.175.zip with a size of 26.7 MB. <\/span>\u00a0<\/span><\/p>\n

\"\"<\/span><\/p>\n

\u00a0<\/span>Figure 6: Screenshot of a ZIP file download from MEGA<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

6. Download is completed and stored in downloads folder<\/span>\u00a0<\/span><\/p>\n

\"\"<\/span><\/p>\n

Figure 7: Zip file downloaded<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

7. A ZIP archive (91.78.127.175.zip, 26.7 MB) file contains a password protected .7z file with .png file containing the password.<\/span>\u00a0<\/span><\/p>\n

\"\"\u00a0<\/span><\/p>\n

Figure 8: Files inside ZIP archive<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

8. The extracted .7z archive contains setup.msi, which is the actual malware payload.<\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

Figure 9: setup.msi file<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

<\/h2>\n

Execution\u00a0<\/span>\u00a0<\/span><\/h2>\n

Upon execution of setup.msi, the malware:<\/span>\u00a0<\/span><\/p>\n

1. Displays a CAPTCHA image to deceive users. upon clicking “OK,” it begins dropping files in the %Roaming% directory.<\/span>\u00a0<\/span><\/p>\n

\"\"<\/span><\/p>\n

Figure 10: Screenshot of CAPTCHA image<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

2. Drops files into the %Roaming% directory.<\/span>\u00a0<\/span><\/p>\n

\"\"<\/span><\/p>\n

Figure 11: Dropped multiple files in %Roaming%<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

 <\/p>\n

Process Execution & Command Lines<\/span>\u00a0<\/span><\/h2>\n

Process Tree<\/span><\/b>\u00a0<\/span><\/h3>\n

\"\"<\/span><\/p>\n

Figure 12: Process Tree<\/span><\/i><\/b>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Command Lines<\/span><\/b>\u00a0<\/span><\/h3>\n