Researchers Expose YouTube Ghost Network Distributing Malware

Check Point researchers mapped a resilient malware distribution operation across YouTube that used more than 3,000 videos and a mix of hijacked and fake channels to deliver infostealers such as Lumma and Rhadamanthys. The network leveraged video content, community posts, and comment farms to create trust and direct viewers to password-protected archives hosted on cloud storage services. Payloads commonly instructed users to disable protections and install cracked software, which in turn executed stealer families that target browser and credential stores. Google removed thousands of videos following the takedown, but the distributed, role-based nature of the campaign—video accounts, post accounts, and interact accounts—makes it resilient to partial removals. Defenders should focus on content-filtering, blocking known payload hosting domains, and educating users that cracked software lures often deliver malware.