Clickflix Phishing Campaign Targets YouTube Creators With Lumma Stealer

Mar 25, 2025 · Original article ↗

Summary

A campaign impersonates brands in partnership emails to lure YouTube creators into a Clickflix flow that runs malicious PowerShell and delivers Lumma Stealer, which targets browser credentials, cookies, and cryptocurrency wallets.

Key points

Phishing emails pose as brand promotions, partnerships, or payment proposals and direct recipients to a fake Microsoft Word page.
The page copies a Base64-encoded PowerShell command to the clipboard and instructs victims to paste it into a PowerShell terminal.
The script downloads and executes payloads, uses obfuscation and scheduled-job persistence, and communicates with attacker-controlled infrastructure.
Lumma Stealer targets saved browser credentials, cookies, autofill data, browsing history, and cryptocurrency wallet data.
Reported command-and-control domains include flowers[.]what-is-game[.]xyz, cat-watches-site[.]xyz, cdn[.]findfakesnake[.]xyz, and cdn[.]cart-newlocate[.]xyz.
The report recommends filtering phishing and malicious domains, monitoring suspicious PowerShell activity, and restricting unauthorized script execution.

Article Details

Attack Vectors: Spearphishing emails impersonate Pictory and offer brand collaborations, promotions, or payment opportunities to YouTube creators.
Emails link to a Google document that directs recipients to open a purported wire-transfer Word form containing a ClickFlix link.
A fake Microsoft Word webpage instructs victims to click “How to fix,” open PowerShell, and right-click; this copies and executes a Base64-encoded PowerShell command.
The PowerShell script downloads and executes malicious content, establishes scheduled-job persistence, and gathers browser credentials, cookies, browsing data, and cryptocurrency-wallet data.
Defensive Notes: Train users, especially content creators, to scrutinize unsolicited sponsorship offers, phishing links, attachments, and misleading pop-ups.
Use email and web filtering, domain-reputation analysis, and browser Safe Browsing to block malicious links and sites.
Monitor suspicious PowerShell activity, including Base64 decoding and remote payload execution; use endpoint protection and application whitelisting.
Use DNS filtering, web proxies, firewalls, and network monitoring to block or detect connections to the reported malicious infrastructure.
Keep operating systems, browsers, and security software updated; restrict unnecessary PowerShell and Windows Script Host use, macros, and unsigned scripts.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`cat-watches-site[.]xyz`	C2 domain listed in the campaign indicators.
DOMAIN	`cdn[.]cart-newlocate[.]xyz`	Threat infrastructure contacted by the malware; listed as C2.
DOMAIN	`cdn[.]findfakesnake[.]xyz`	Threat infrastructure contacted by the malware; listed as C2.
DOMAIN	`flowers[.]what-is-game[.]xyz`	C2 domain contacted by the malware.
IPV4	`104[.]21[.]38[.]22`	IPv4 address listed among the campaign indicators.
IPV4	`104[.]78[.]173[.]167`	IPv4 address observed in connection with the reported threat infrastructure.
IPV4	`172[.]67[.]199[.]240`	IPv4 address listed among the campaign indicators.
SHA256	`cace23a661e2792804416147df9dcf3ef59ebf56cfaf9c20d0813aa5f0d95613`	Hash listed as an indicator for the campaign's malware artifact.
URL	`hxxps[:]//cat-watches-site[.]xyz/api/$jeep`	Malicious API endpoint associated with the campaign's C2 domain.