Cyber Threat Actor: Prosox

Prosox is an online alias used by one member of a hacking duo that operates under the Twitter handles “Kuroi’sh & Prosox.” The threat actor is publicly associated with the United States of America, as indicated in the available context. The pair describes themselves as a duo of hackers who claim to exploit perceived weaknesses in large organizations’ security postures. They have presented themselves as capable of bypassing what they characterize as inadequate defenses, asserting that even well‑known companies are vulnerable to intrusion.

Their observed activity focuses on the media sector, specifically targeting video‑hosting platforms and social‑media accounts. Prosox and their partner have compromised the official YouTube channel of Vevo, a multinational video‑hosting service, and have also taken control of the Twitter accounts of BBC Arabia and NowThis News. The actors explicitly stated that the Vevo intrusion was carried out “for Palestine,” indicating a politically motivated objective rather than financial gain or espionage. The resulting actions included defacing video titles, deleting the high‑view Despacito music video, and altering the handles and content of the compromised Twitter profiles.

The tactics described in the reporting involve gaining administrative control of Vevo’s backend server, which the actors claimed to be “connected with an INVULP,” and then using that access to alter and delete content. They also demonstrated the ability to hijack social‑media accounts, suggesting credential‑based takeover or session‑hijacking techniques. No specific malware families, exploit kits, or custom tooling are mentioned in the source material, so the observable TTPs are limited to server compromise, account takeover, defacement, and data deletion.

Attribution to a state sponsor or a formal criminal consortium has not been established in the public record. The article notes a prior breach of Vevo by the Saudi‑Arabian‑linked OurMine group, but it remains unclear whether that incident facilitated Prosox’s later access, and no direct link between the two groups is asserted. Consequently, Prosox appears to operate as an independent hacking duo without demonstrable state affiliation or membership in a larger criminal network.

Notable operations attributed to Prosox include the Vevo YouTube campaign that resulted in the defacement of videos belonging to artists such as Luis Fonsi, Adele, Shakira, and Drake, alongside the deletion of the Despacito video. Shortly before that, the duo reportedly hijacked the Twitter accounts of BBC Arabia and NowThis News, using those platforms to disseminate messages. These incidents represent the actor’s publicly reported activity, illustrating a pattern of targeting high‑visibility media properties to achieve disruption and convey a political statement.