Loading story…
Google, in collaboration with Check Point researchers, dismantled a large-scale malware distribution campaign on YouTube known as the 'YouTube Ghost Network.' This operation involved over 3,000 malicious videos posted across compromised and fake YouTube accounts, which lured users with promises of cracked software and game cheats. Victims were instructed to disable antivirus protections and download archives from cloud storage services, which contained infostealers such as Rhadamanthys and Lumma. The campaign, active since at least 2021 and surging in 2025, weaponized YouTube engagement features—such as likes, comments, and community posts—to create a false sense of legitimacy and trust around the malicious content.
The Ghost Network's structure mirrored previous malware distribution tactics seen on other platforms, with different accounts assigned to upload videos, post community updates, and interact in comment sections to boost credibility. The majority of the malware distributed targeted user credentials, crypto wallets, and sensitive system data. Following the disruption of the Lumma infostealer, the network shifted to distributing Rhadamanthys. The takedown of these videos and accounts has significantly reduced the threat, but the campaign highlights the evolving sophistication of platform-based malware delivery and the risks associated with downloading pirated software from untrusted sources.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
On October 23, 2025, Check Point and subsequent coverage publicly exposed the 'YouTube Ghost Network,' detailing its tactics, malware families including Lumma and Rhadamanthys, and its use of legitimate platforms such as Google Drive, Dropbox, and MediaFire.
After Check Point reported the network to Google, the company removed most of the identified malicious YouTube videos, with one report characterizing the action as the takedown of roughly 3,000 videos.
Check Point Research identified a large coordinated malware distribution network tied to more than 3,000 YouTube videos, using compromised and fake accounts, comments, likes, and external file-hosting services to spread infostealers and loaders.
Researchers reported the operation's activity later surged, with output tripling during 2024 according to some reports, indicating a major escalation in the volume of malicious YouTube content.
Check Point said the 'YouTube Ghost Network' has been active since at least 2021, using YouTube videos to lure users seeking cracked software, pirated tools, and game cheats into downloading malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcezdnet.com
Open sourceresearch.checkpoint.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new malware campaign has been identified in which threat actors are distributing the GachiLoader and CountLoader malware through YouTube video links and cracked software distribution sites. Users are lured into clicking on malicious links embedded in YouTube videos or downloading pirated software, which initiates a multi-stage infection process. The campaign leverages social engineering and popular platforms to maximize reach and evade traditional detection methods. Technical analysis reveals that the attack chain often begins with a ZIP archive containing a renamed Python interpreter, which executes malicious commands to retrieve CountLoader 3.2 using `mshta.exe`. The malware establishes persistence by creating scheduled tasks that mimic legitimate Google processes and adapts its behavior if security tools like CrowdStrike Falcon are detected. CountLoader is capable of delivering additional payloads such as Cobalt Strike, PureHVNC RAT, and Amatera Stealer, and the latest variants include features for host profiling and propagation via removable media.
Jun 29, 2026
Security researchers reported sustained infostealer activity centered on **Lumma Stealer** and **Vidar**, with operators distributing malware through fake CAPTCHA lures, pirated software downloads, phishing emails, and poisoned search results. AhnLab said July 2026 campaigns commonly delivered **Remus, LummaC2, ACRStealer, and Vidar** via cracked software hosted on services including **mega.nz**, **Amazon S3**, and **MediaFire**, while Microsoft and other well-known brands were frequently impersonated. TrendAI separately described fake verification pages that trick victims into pasting malicious commands into the Windows Run dialog, leading to multistage infections that deployed **Lumma Stealer, Rhadamanthys, AsyncRAT, XWorm,** and **Emmenhtal**. The campaigns relied on evasive execution chains using `mshta.exe`, obfuscated PowerShell, DLL sideloading, temporary Chromium profiles, and even MP3 files carrying injected JavaScript to load payloads in memory and communicate with attacker-controlled infrastructure. Researchers also said **Vidar Stealer 2.0** expanded its appeal with a rewritten codebase, multithreaded theft, stronger anti-analysis, and broader credential and wallet theft, helping it gain momentum as some criminals moved away from Lumma after a doxxing incident and Telegram account compromise disrupted Lumma operations and eroded trust in its malware-as-a-service ecosystem. The reporting indicates that infostealer operators are rapidly shifting delivery methods and malware families while continuing to target both enterprises and individual users for credential theft and follow-on attacks.
Aug 21, 2026
Multiple active **social-engineering-driven malware operations** are targeting end users through trusted distribution channels. One campaign, dubbed **GhostPoster**, distributed **17 malicious browser extensions** across *Chrome, Firefox, and Edge* with **840,000+ installs**, using legitimate-sounding names (e.g., “Google Translate in Right Click,” “Youtube Download,” “Ads Block Ultimate”) and evading store reviews for years. The extensions used **steganography** to hide code in PNGs, then extracted payloads to contact attacker infrastructure, enabling credential/data theft, tracking, affiliate-link hijacking, script injection, and HTTP header manipulation to weaken protections. Separately, threat actors are impersonating **Malwarebytes** via trojanized ZIP “installers” (e.g., `malwarebytes-windows-github-io-X.X.X.zip`) and using **DLL sideloading**—pairing a legitimate EXE with a malicious `CoreMessaging.dll`—to execute **infostealers**; reporting highlighted a campaign fingerprint via **behash** `4acaac53c8340a8c236c91e68244e6cb` and distinctive DLL strings used for infrastructure mapping. A different operation identified by CloudSEK involves **“RedLineCyber”** masquerading as an affiliate of “RedLine Solutions” to build credibility inside private **Discord** communities and deliver a Python-based **clipboard hijacker** (often `Pro.exe` / `peeek.exe`) aimed at **cryptocurrency wallet theft**, relying on long-term grooming of high-value targets rather than broad phishing.
Jun 29, 2026