Tag: youtube

9 Attack Reports | 0 Vulnerabilities

Attack reports

GachiLoader: Defeating Node.js Malware with API Tracing

A new malware distribution campaign utilizing compromised YouTube accounts to spread infostealers has been identified. The campaign employs GachiLoader, a heavily obfuscated Node.js loader, to deploy the Rhadamanthys infostealer. GachiLoader implements anti-analysis techniques and uses a novel PE i…

Published: December 17, 2025

Downloadable IOCs: 10

Dissecting YouTube's Malware Distribution Network

Check Point Research uncovered a sophisticated malware distribution campaign operating on YouTube, dubbed the YouTube Ghost Network. This network utilizes over 3,000 malicious videos to spread malware, primarily targeting users seeking game cheats and pirated software. The operation involves compro…

compromised accounts

Published: October 23, 2025

Downloadable IOCs: 0

Proxyware Malware Being Distributed on YouTube Video Download Site

A malicious campaign is targeting users through fake YouTube video download sites, distributing Proxyware malware. The attack involves a downloader disguised as WinMemoryCleaner, which installs NodeJS and runs malicious JavaScript. This script then installs various Proxyware programs, including Dig…

Published: August 22, 2025

Downloadable IOCs: 0

Smart Contract Scams | Ethereum Drainers Pose as Trading Bots to Steal Crypto

SentinelLABS has uncovered a series of cryptocurrency scams where threat actors distribute malicious smart contracts disguised as trading bots to drain user wallets. The campaign has stolen over $900,000 US and uses aged YouTube accounts with curated comment sections to create a false sense of legi…

ai-generated content

Published: August 7, 2025

Downloadable IOCs: 0

Crypto Scammers Exploit: Elon Musk Speaks on Cryptocurrency

Cybercriminals are exploiting a live stream featuring Elon Musk, Cathie Wood, and Jack Dorsey discussing cryptocurrency to conduct scams. They modify the original video, adding frames that advertise malicious websites claiming to double users' cryptocurrency investments. Multiple YouTube channels w…

social media exploitation

double investment

Published: April 2, 2025

Downloadable IOCs: 10

YouTube Creators Under Siege Again: Clickflix Technique Fuels Malware Attacks

Cybercriminals are targeting YouTube creators with a sophisticated malware campaign using the Clickflix technique. Attackers impersonate popular brands and offer fake collaboration opportunities to lure victims. The campaign employs spearphishing emails with malicious attachments and links to fake …

social engineering

credential theft

Published: March 25, 2025

Downloadable IOCs: 5

Lumma Stealer Malware Thrives as Unique Patterns Uncovered in the Infostealer's Domain Clusters

Recent research reveals Lumma Stealer command and control domain clusters share specific technical characteristics, enabling mapping of entire infrastructure clusters. The infostealer's logs are being shared for free on Leaky[.]pro, a new hacking forum, offering billions of stolen credential record…

credential theft

c2 infrastructure

domain clusters

Published: February 22, 2025

Downloadable IOCs: 0

How Threat Actors Exploit Brand Collaborations to Target Popular YouTube Channels

Cybercriminals are targeting YouTube creators through sophisticated phishing campaigns that impersonate trusted brands offering collaboration deals. The malware is disguised as legitimate documents and delivered via password-protected files on platforms like OneDrive. Once downloaded, it steals sen…

social engineering

brand impersonation

content creators

Published: December 17, 2024

Downloadable IOCs: 3

Threat Actors Hack YouTube Channels to Distribute Infostealers

This analysis reveals that malicious groups have been exploiting popular YouTube channels, including some with over 800,000 subscribers, to distribute various infostealer malware strains like Vidar and LummaC2. The attackers upload videos promoting cracked software with links to malicious payloads …

malware distribution

compromised accounts

Published: May 10, 2024

Downloadable IOCs: 13

Click here to see more Attack Reports