Loading story…
A new malware campaign has been identified in which threat actors are distributing the GachiLoader and CountLoader malware through YouTube video links and cracked software distribution sites. Users are lured into clicking on malicious links embedded in YouTube videos or downloading pirated software, which initiates a multi-stage infection process. The campaign leverages social engineering and popular platforms to maximize reach and evade traditional detection methods.
Technical analysis reveals that the attack chain often begins with a ZIP archive containing a renamed Python interpreter, which executes malicious commands to retrieve CountLoader 3.2 using mshta.exe. The malware establishes persistence by creating scheduled tasks that mimic legitimate Google processes and adapts its behavior if security tools like CrowdStrike Falcon are detected. CountLoader is capable of delivering additional payloads such as Cobalt Strike, PureHVNC RAT, and Amatera Stealer, and the latest variants include features for host profiling and propagation via removable media.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers discovered a separate malware campaign dubbed the 'YouTube Ghost Network' that uses compromised or abused YouTube video links to distribute the Node.js-based GachiLoader malware. The loader was reported to use anti-analysis and PE injection techniques and to deliver malware such as the Rhadamanthys stealer, with DDoS-related capabilities also noted.
Security researchers identified a malware distribution campaign using cracked software websites to deliver CountLoader, a modular loader. The campaign was found to deploy payloads including ACR Stealer and to use persistence, evasion, fileless execution, and USB propagation techniques.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified CountLoader, a new malware loader used by Russian ransomware groups to deliver tools like Cobalt Strike and PureHVNC RAT. The loader is distributed via phishing campaigns, particularly targeting Ukraine, and leverages multiple file types and living-off-the-land binaries for persistence and execution. CountLoader's infrastructure supports major ransomware affiliates and demonstrates advanced malware development techniques.
Jun 29, 2026
Researchers exposed an active **LegionLoader** malware campaign, also tracked as **Satacom**, **CurlyGate**, and **RobotDropper**, that uses drive-by-download lures and short-lived redirect pages to push password-protected archives from file-sharing services such as **Mega**. The archives contain MSI installers that unpack and sideload a malicious `obs.dll`, which decrypts shellcode and a second-stage executable before using **process hollowing** into `explorer.exe` to continue execution. Analysis found heavy use of `.monster` domains, hard-coded command-and-control infrastructure, and tooling intended to download additional payloads, although some observed C2 servers were inactive during review. The activity aligns with earlier Satacom operations that abused malicious or compromised websites and fake download buttons to distribute malware disguised as free or cracked software. In prior campaigns, the loader fetched follow-on payloads through DNS TXT lookups and PowerShell, then installed a fake Chromium-based **"Google Drive"** extension that targeted cryptocurrency users by stealing wallet data, manipulating transactions, bypassing 2FA, and suppressing transaction emails across Gmail, Hotmail, and Yahoo. The newer findings indicate the operators continue to rely on staged delivery, stealthy execution, and flexible payload retrieval, while defenders have been provided with hashes, URLs, file paths, registry artifacts, and **YARA** rules to detect the campaign.
Aug 15, 2026
Threat researchers reported separate malware campaigns that used fake or pirated software distribution channels to infect Windows users with credential theft and traffic-interception malware. In one campaign, attackers seeded cracked software sites with a trojanized `WinX_DVD_Copy_Pro.exe` that launched an obfuscated HTA through `MSHTA`, deployed an upgraded **CountLoader v3.2**, and ultimately delivered **ACR Stealer** entirely in memory. The loader established persistence with scheduled tasks, profiled infected hosts, authenticated to command-and-control with a JWT token, and supported additional payload delivery through ZIP, DLL, MSI, PowerShell, and removable-media propagation tasks. A second campaign abused interest in **DeepSeek-R1** by promoting a fake DeepSeek site through Google Ads and delivering a malicious installer, `AI_Launcher_1.21.exe`, backed by fake CAPTCHA pages, PowerShell, AES-decrypted payloads, and a domain-generation routine. The final malware, **BrowserVenom**, installed a rogue root certificate and reconfigured browsers to send traffic through the attacker-controlled proxy `141.105.130[.]106:37121`, allowing interception and collection of user web activity. Researchers said the operations relied on impersonation-themed infrastructure and low-detection payloads to evade defenses, with BrowserVenom infections observed in Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt.
Aug 14, 2026