Dissecting YouTube's Malware Distribution Network

Check Point Research identified a sophisticated malware distribution campaign on YouTube called the YouTube Ghost Network. This network uses over 3,000 malicious videos to spread infostealer malware, primarily Lumma and Rhadamanthys, targeting users seeking game cheats and pirated software. The operation involves compromised YouTube accounts assigned roles such as video uploaders, community posters, and interaction simulators. Active since 2021, the campaign saw a significant rise in activity in 2025. It employs evasion techniques including password-protected archives and frequent updates to malware payloads and command-and-control infrastructure. The campaign highlights evolving malware distribution tactics on popular platforms.

• StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver themMalware2026-06-24
• Operation Endgame disrupts Amadey and StealcMalware2026-06-24
• User interaction with a ClickFix-style phishing site resulted in execution of an obfuscated PowerShell commandMalware2026-04-29
• Unmasking The 64-bit Variant of the Infamous Lumma StealerMalware2026-04-08
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking MalwareMalware2026-10-21