533 YouTube Channels, One Lure: Measuring the Fake-Cheat Malware Economy

At a glance

How we ran it

For years, the economics of this kind of research favored the attacker: uploading another lure video takes minutes, while working out what it serves takes an analyst hours. Agents change that math. An orchestrating agent split the work into tracks (crawling, triage, reverse engineering, detonation and infrastructure), ran subagents on each, and re-verified what they reported before it counted. One researcher steered, reviewed and made the calls the agents shouldn't.

The video lure itself isn't news. Proofpoint documented apparently compromised YouTube accounts pushing infostealers behind cracked games in 2024, and Check Point mapped more than 3,000 malicious videos in what it called the YouTube Ghost Network in 2025. We set out to measure the problem at scale: downloading and running the files behind these video lures to see what they actually do, and matching payload hashes back to the channels promoting them.

As agents took on more of the malware analysis, our work shifted toward analyzing the analysis. We encountered tools that reported success after failing, apparent connections that did not hold up, and counts that did not survive a recount. We checked artifacts by hash, traced claims back to evidence and reran the queries behind headline numbers. The agents took on more of the work. The researcher still decided what counted as a finding.

Stage 1: Finding the lures

A video promises free cheats for Metin2, an online game. The description points to a password-protected download on MediaFire and supplies what viewers need to open it. Across these lures, instructions to disable antivirus turn a security warning into an apparent installation hurdle: something to switch off so the cheat will work.

Unbeknownst to the viewer, the Metin2 download bundles a legitimate Notepad++ updater with malicious code. Launching the updater also loads that code, a technique called DLL side-loading. What begins as a shortcut to winning a game starts an infection chain leading to a remote-access trojan designed to give the attacker remote control of the victim's PC.

To find lures like this at scale, we built a crawler on a third-party YouTube search API. It works breadth-first: seed queries lead to channels, channels to descriptions, descriptions to links and brand names, and brand names to new queries. A video counts as a lure candidate when its title or description carries a lure phrase or a password marker and links to at least one non-social host. In roughly a day, the crawler collected metadata for 324,666 videos. It flagged 22,941 videos across 4,530 channels as potential download lures: posts combining cheat-related language or mentions of archive passwords with links to external sites.

Triaging 223,339 videos for $20

A link and a cheat keyword make a video suspicious, but checking 223,339 descriptions by hand wasn't possible. Sending every video to a large AI model would have been too expensive and slow. Instead, we used Jev, a fast decision model from TypeSafe AI that gives clear probability scores rather than free-form text answers.

Before prompting Jev, we looked for characteristics shared by malicious videos we had already identified: password-protected downloads, instructions to disable antivirus, or reassurance that detections are false positives. Those examples gave us concrete features, but also risked overfitting to familiar lures. We turned those cues into yes/no questions with probability scores, added a multiple-choice question identifying the offer, and asked Jev to evaluate each video's title, channel name, description, and links. Our code then combined the signals to prioritize investigation.

Here's one real decision, for a Valorant cheat video whose description links a MediaFire folder, gives "Password: valoranthack" and walks the viewer through disabling antivirus and SmartScreen:

The video's instructions to disable antivirus received an av_coaching score of 0.99. Combined with the folder name matching the archive password, this made the video a top priority for investigation.

Jev produced scores, not verdicts. We set the cutoffs ourselves, reading scored videos in order until the lures stopped looking like lures. Each video landed in a band, and each band was an instruction: investigate first, check the links, or drop. Videos too short to score went to their own tier instead of the trash. The manual pass was not a weakness in the method; it was the method. Deciding what counts as a lure is judgment work, and every channel in this post entered through that judgment.

The Jev schema used to triage the videos is published.

Stage 2: From links to payloads

With the candidates narrowed down, the next question was what the archives actually contain.

Triaging files with Jev

Downloading the archives left us with thousands of Windows programs to sort through, many of them legitimate. In a follow-up experiment, we tested whether Jev could help us choose which files deserved a closer look.

Our starting point was the warning signs shared by malware we had already confirmed, such as commands to weaken antivirus protection or references to saved browser passwords. Scripts collected those features without running the files, pulling out text, commands, Windows function references and details of each file's layout. Legitimate software got the same check, to test for overfitting to familiar examples.

One file contained a command telling Windows Defender to skip scanning the computer's temporary folder. We gave Jev that finding alongside the file's other extracted features.

That made the file worth a closer look, but did not establish that it was malware. The 0.96 applies to the security-change answer. Whether the file would download and run more code remained unclear.

For $0.86, Jev screened more than 5,300 Windows files using the same set of triage questions. That gave us a consistent first pass across the collection and leads to prioritize for deeper investigation. Flagged archives still needed further analysis before they could enter our count of malicious archives.

The Jev prompt used to triage the binaries is published.

Agents in IDA

Reverse-engineering agents operated IDA Pro through ida-pro-mcp, an open-source MCP server for IDA. It supports one client at a time, so we wrote a custom wrapper that lets agents work in parallel sessions.

We used IDA to look inside the downloaded programs: follow their functions, identify hidden payloads and trace how they contact attacker infrastructure. Its disassembler and decompiler make compiled code readable enough to investigate those questions.

One loader we analyzed shows why that matters. Its next-stage payload was encrypted inside the executable. Tracing the loader revealed a five-pass decryption routine, which we reproduced to recover that payload. Examining the recovered code then exposed three hardcoded command-and-control servers and a fallback that reads another server address from an Ethereum smart contract. We identified that fallback in code; we did not observe it execute during sandbox runs.

Our agents used IDA to reverse-engineer the malware and understand how it works, including code paths a sandbox run might never reach. Detonation, discussed next, let us watch it in action in a controlled environment.

Detonating in Mortex

We ran detonations in Mortex, the system we built to turn Claude Code into a malware analysis pipeline. Samples ran with simulated networking, and a run counted only with a run record, a verified collector, and containment checks before and after. One loader refused to run with fewer than 4 vCPUs or under a known sandbox user name.

Detonation changed one of our conclusions. One implant appeared to carry a built-in deadline after which it would stop working. Thirteen hours past that deadline, a full run executed the whole chain and connected to its command-and-control server. The deadline was a claim the code made, and the run refuted it.

With the payloads identified and their behavior confirmed, each one was matched to every channel that served it. A channel counts only when the video disclosed the password, or the archive needed none, and the match is the full SHA-256. At least 533 channels and 4,062 videos link to 1,257 malicious archives. Where the payload was observed or verified directly, the count is 275 channels and 2,772 videos. Both are floors, because many hosts were already offline.

Stage 4: Mapping the infrastructure

Reverse engineering revealed the hostnames used by the malware for command and control. We used Mallory's domain intelligence service to investigate their history and look for related infrastructure.

The service records daily changes to domains and nameservers and collects domain names from public Certificate Transparency logs. Certificate records can reveal additional domains and subdomains to investigate. Combined with registry records, that history helped us reconstruct the infrastructure's timeline, including domains that were already offline.

For example, lure descriptions in our crawl pointed viewers to a cheat storefront called cyrexmods, at cyrexmods.to and cyrexmods.cc. Searching that name through Mallory's domain intelligence service found cyrexmods on six top-level domains and a one-letter variant, cyrexmodes, on two more.

Registration and nameserver history helped connect those discoveries. Two cyrexmods domains, on .sbs and .top, were registered the same day and shared nameservers. More than once, a replacement domain appeared within about a day of the previous one going dark. That pattern suggested a storefront changing domains while keeping its brand.

One domain intelligence search turned one download host into a storefront operating under the same name on several TLDs.

A single download domain gave us a starting point. Mallory's domain intelligence expanded that lead across multiple top-level domains, while registration and nameserver history showed a pattern consistent with the storefront replacing domains as earlier ones went dark.

The malware behind the lure

We reverse-engineered five malware families in depth, and public threat intelligence already tracks all of them. Threat feeds, sandbox records and vendor reports match them to Vidar, RevStealer, MopsStealer, OXLOADER with CastleStealer, and Remus. These are matches, not verified identifications: we compared our indicators and the traits vendors published, not samples byte for byte.

One cluster dwarfs the rest in reach. It behaves like RedLine, a commodity stealer that has been sold and operated for years. Sandbox runs matched two of its files to RedLine; the rest of the cluster matches those two by similarity. Counted the same way, that cluster alone reaches 231 channels.

Remus takes us back to the Lumma infection we opened with. One loader in our collection unpacks a stealer carrying the traits Gen Digital uses to identify Remus, which Gen places in the Lumma family tree. We did not compare it against a Lumma sample, so that link rests on Gen's attribution, but the infrastructure points the same way: Mallory's records label the servers this loader pulls from its Ethereum contract as Remus, and one of them, chalx.live:5902, is in Gen's published Remus indicators.

What defenders should take from this

The lures in this study land on personal machines: a gaming PC, a shared family laptop, a contractor's own device. These endpoints have no MDM enrollment and no EDR, and they're often one browser profile away from corporate SaaS. A stealer doesn't need to beat your endpoint stack if it runs where that stack was never installed. Mandiant found the same path in the 2024 Snowflake intrusions. In several cases the initial infostealer infection "occurred on contractor systems that were also used for personal activities, including gaming and downloads of pirated software." So the controls that matter here sit at the identity layer:

• Require managed, compliant devices for sensitive apps; restrict unmanaged sessions.
• Keep work credentials out of personal browser profiles.
• MFA alone does not prevent session theft.
• For stealer-log hits, revoke sessions and refresh tokens, rotate credentials, and review OAuth grants.

For teams doing this kind of research, two lessons carry over.

• Spend cheap model calls on the volume sort, and send videos with too little text to their own tier instead of dropping them.
• A tool that exits cleanly, or a lookup that returns nothing, is not a negative result. Hash the file, and log the failure.