Threats tagged 'youtube'

A new malware distribution campaign utilizing compromised YouTube accounts to spread infostealers has been identified. The campaign employs GachiLoader, a heavily obfuscated Node.js loader, to deploy the Rhadamanthys infostealer. GachiLoader implements anti-analysis techniques and uses a novel PE injection method called Vectored Overloading. To aid analysis, researchers developed an open-source Node.js tracer tool. The campaign has affected over 100 videos with 220,000 views across 39 compromised accounts since December 2024. The malware evades detection, elevates privileges, and disables Windows Defender before retrieving its payload.

Campaign#pe injection#api tracingGermany+9

Check Point Research identified a sophisticated malware distribution campaign on YouTube called the YouTube Ghost Network. This network uses over 3,000 malicious videos to spread infostealer malware, primarily Lumma and Rhadamanthys, targeting users seeking game cheats and pirated software. The operation involves compromised YouTube accounts assigned roles such as video uploaders, community posters, and interaction simulators. Active since 2021, the campaign saw a significant rise in activity in 2025. It employs evasion techniques including password-protected archives and frequent updates to malware payloads and command-and-control infrastructure. The campaign highlights evolving malware distribution tactics on popular platforms.

A malicious campaign is targeting users through fake YouTube video download sites, distributing Proxyware malware. The attack involves a downloader disguised as WinMemoryCleaner, which installs NodeJS and runs malicious JavaScript. This script then installs various Proxyware programs, including DigitalPulse, HoneyGain, and recently, Infatica. The malware uses Task Scheduler for persistence and sends system information to a C&C server. The Proxyware exploits the infected system's network bandwidth for the attacker's profit. Users in South Korea have been particularly targeted. To prevent infection, users should avoid installing executables from suspicious websites and use antivirus software.

Malware#youtube#digitalpulseSouth Korea+5