Cyber Incident Victim: WatchMojo
Date:
Jun 2016
Location:
Canada
Summary
A group called 'Obnoxious and Pein' compromised multiple high-profile YouTube channels, including one with over 12 million subscribers, altering years of video titles to display hacking messages. The affected entity's Facebook page displayed outdated content, though other social platforms remained operational. A secondary victim experienced broader account takeovers across YouTube, Twitter, and PayPal, with attackers circumventing two-factor authentication by exploiting reused credentials. While YouTube and PayPal access was restored, the Twitter account remained suspended post-recovery attempts. The incident raised concerns about platform security despite implemented protective measures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On June 25, 2016, the YouTube channels WatchMojo and RedMercy were compromised by hackers identifying themselves as 'Obnoxious and Pein.' The attackers targeted WatchMojo, a channel with over 12.2 million subscribers, altering the titles of nine years' worth of videos to display "Hacked by 'Obnoxious and Pein' Twitter (dot) com/poodlecorp." The channel's associated website, Twitter, and Instagram accounts remained unaffected, but its Facebook page exhibited irregularities, with the last visible post dating to November 2014. It was unclear whether this anomaly resulted from hacking activity or deliberate content suppression. Concurrently, RedMercy—a gaming commentary channel with approximately 975,765 subscribers owned by Dmitry Garanin—faced a more extensive breach. Attackers compromised Garanin’s YouTube, Twitter, and PayPal accounts, despite his claims of having two-factor authentication enabled on all services. Garanin later acknowledged reusing passwords across platforms, facilitating sequential account takeovers.
The attackers’ modifications to WatchMojo’s video catalog risked disrupting advertising revenue and damaging the channel’s credibility with sponsors. RedMercy’s operational impact included temporary loss of control over monetized platforms, compounded by the repeated hacking of his Twitter account, which Twitter subsequently suspended. Garanin responded by posting two videos to his restored YouTube channel, informing subscribers of the breach and security shortcomings. By the time initial reports circulated, WatchMojo’s YouTube and Facebook presence had been restored, while RedMercy regained access to YouTube and PayPal but remained locked out of Twitter. Neither Google nor WatchMojo issued public statements regarding the intrusion methodology, leaving unresolved questions about the bypass of two-factor authentication and the initial attack vectors. The incidents highlighted systemic vulnerabilities in account security practices across high-profile YouTube channels.