Want to learn how to use a phishing kit? Just go to YouTube.

That's right. Criminals are using YouTube as a combined technical support desk and malware distribution channel.

Proofpoint researchers have uncovered cyber-criminals posting "how to" videos. And under the post in the comments section, the criminals have posted links to the phishing templates and kits.

Proofpoint says "many of the video samples we found on YouTube have been posted for months, suggesting that YouTube does not have an automated mechanism for detection and removal of these types of videos and links."

If someone uses the links and downloads the kit, employs it and obtains credential, those credentials are also sent to the cyber-criminals.

YouTube is not the only service that is being subverted for criminal activity. Andy Norton, risk officer EMEA at SentinelOne, says that "Facebook has a community of Carders profiles; people who advertise, sell and recruit others for the purposes of extracting money from stolen bank accounts and credit cards."

Source: SCMagazine