Report: YouTube Displays Ads Containing Secret Cryptocurrency Miner

YouTube has reportedly been displaying ads with embedded cryptocurrency miners to viewers.

Ars Technica reports that YouTube has been servings ads to their customers with secretly embedded cryptocurrency miners that hijack viewer’s CPU power to mine digital currency. On Tuesday, people began noticing antivirus reports of cryptocurrency miners being activated when they visited YouTube videos, some took to social media to express their worries about the issue,

Hey @avast_antivirus seems that you are blocking crypto miners (#coinhive) in @YouTube #ads
Thank you :)https://t.co/p2JjwnQyxz

— Diego Betto (@diegobetto) January 25, 2018

Antivirus provider Trend Micro reported on Friday that the ads caused cryptocurrency miner detections to triple this week. Trend Micro said that the creators of the advertisements exploited Google’s DoubleClick ad platform to display the crypto mining ads to users in certain countries including Japan, France, Taiwan, Italy, and Spain. The ads were using YouTube viewers CPU’s to mine the popular cryptocurrency Monero, in the majority of cases the mining script used was publicly available JavaScript provided by cryptocurrency mining service Coinhive.

Independent security researcher Troy Mursch told Ars Technica, “YouTube was likely targeted because users are typically on the site for an extended period of time. This is a prime target for cryptojacking malware, because the longer the users are mining for cryptocurrency the more money is made.” This is likely why TV network Showtime suffered from a similar problem on their streaming website in September.

A Google representative commented on the issue saying:

Mining cryptocurrency through ads is a relatively new form of abuse that violates our policies and one that we’ve been monitoring actively. We enforce our policies through a multi-layered detection system across our platforms which we update as new threats emerge. In this case, the ads were blocked in less than two hours and the malicious actors were quickly removed from our platforms.

It seems that cryptojacking has become one of the most popular ways for hackers to generate income in recent years, one security researcher Willem de Groot, alleged that as many as 2,496 websites were utilizing cryptominers to generate income from website users.