YouTube Scam Lures Eager ‘Doctor Who’ Fans to Reveal Personal Data
iSpeech.org
“Doctor Who” may be one of the most popular science fiction series of all time, but anyone interested in streaming the new season should check for factual accuracy before creating a “free” online account.
Researchers discovered a litany of YouTube channels that supposedly offer access to season 11 of the long-running British TV show, but may actually be duping people into handing over personal information. According to Malwarebytes, the YouTube scams include links that direct viewers to offers featuring “Doctor Who” imagery, encouraging them to sign up to watch the show.
YouTube Scam Could Be After Personal Data
[adsense size='1' ]
Though the pop-up box suggests that watching the latest “Doctor Who” episodes comes at no cost, other areas of the same sites include prompts to “try this service for free” — which could mean users will be billed later or denied access unless they opt for a premium version of a streaming service.
The researchers noted that the operators of the YouTube scam often used outdated photos from previous seasons of the show, which should be a giveaway that their offers aren’t legitimate. Besides gathering names, email addresses and other personal data, such scams can lead unsuspecting users to illegal or pirated versions of copyrighted content, including TV series like “Doctor Who.”
Unlike a more traditional business, these scams sometimes ask for credit card information up front, even if they fail to offer substantial details about the services they purport to provide.
The Power of Penetration Testing
Given that employees might be looking for “Doctor Who” streaming options on their lunch hour, companies must be vigilant when this type of scam makes news headlines. While most phishing scams use email as an initial lure, they often lead to similarly dubious websites that ask people to enter data.
IBM security experts recommend conducting penetration testing to determine which social engineering scenarios pose the greatest risk to the organization. Simulated phishing engagements can also help security leaders enforce secure behaviors, such as making sure a website is what it claims to be and doing some extra research online before clicking through.
Source: Malwarebytes
Gloss