YouTubeTA
YouTubeTA (short for “YouTube Threat Actor”) is a StealC malware-as-a-service operator/customer profiled by CyberArk Labs in 2025. The actor was observed using StealC infostealer campaigns with build IDs including “YouTube,” “YouTube2,” and “YouTubeNew.” Reporting indicates the actor used YouTube-themed distribution, likely hijacking older legitimate YouTube channels with established subscribers using compromised credentials and planting malicious links. Victim screenshots associated with the actor’s StealC infrastructure showed users searching YouTube for cracked Adobe Photoshop and Adobe After Effects, and some observed activity suggested use of ClickFix-like fake CAPTCHA social engineering. Panel data indicated the operation maintained over 5,000 victim logs containing roughly 390,000 stolen passwords and more than 30 million stolen cookies. The actor’s panel configuration included markers for studio.youtube.com, consistent with interest in hijacking YouTube creator accounts. CyberArk assessed YouTubeTA was likely a single operator because the panel showed only one user (“Admin”) and fingerprinting was consistent across sessions. Observed fingerprints indicated use of an Apple Pro/M3-based device, English and Russian language support, and a GMT+0300 time zone. In mid-July 2025, a non-VPN panel access event exposed an IP associated with Ukrainian ISP TRK Cable TV, supporting only a limited attribution hypothesis of an Eastern European, likely Ukrainian-linked operator. Alias: YouTubeTA.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Media & Entertainment
Where they're from
Attributed origin per open-source reporting.
- UA
Tradecraft
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A StealC MaaS customer that distributes StealC via YouTube by promoting cracked software (e.g., Adobe Photoshop/After Effects), likely hijacking legitimate YouTube accounts to create a self-propagating distribution loop; also uses fake CAPTCHA lures to deliver the stealer.
A StealC operator involved in credential theft and cookie theft, apparently using compromised YouTube channels and stolen studio.youtube.com credentials to distribute StealC and expand malware distribution.
A StealC MaaS customer/operator running malware distribution campaigns via hijacked YouTube channels, using compromised credentials and malicious links to infect victims and steal credentials/cookies at scale.
Single StealC MaaS operator running campaigns that abuse/hijack YouTube accounts and distribute StealC via YouTube content (e.g., cracked Adobe software lures), stealing credentials and cookies from victims and highlighting YouTube creator credentials (studio.youtube.com) for account takeover.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.