3,000 YouTube Movies Uncovered as Malware Traps in Huge Ghost Community Operation

Oct 24, 2025Ravie LakshmananMalware / Hacking Information

A malicious community of YouTube accounts has been noticed publishing and selling movies that result in malware downloads, basically abusing the recognition and belief related to the video internet hosting platform for propagating malicious payloads.

Lively since 2021, the community has revealed greater than 3,000 malicious movies thus far, with the amount of such movies tripling for the reason that begin of the yr. It has been codenamed the YouTube Ghost Community by Examine Level. Google has since stepped in to take away a majority of those movies.

The marketing campaign leverages hacked accounts and replaces their content material with “malicious” movies which can be centred round pirated software program and Roblox recreation cheats to contaminate unsuspecting customers looking for them with stealer malware. A few of these movies have racked up a whole lot of hundreds of views, starting from 147,000 to 293,000.

“This operation took benefit of belief indicators, together with views, likes, and feedback, to make malicious content material appear secure,” Eli Smadja, safety analysis group supervisor at Examine Level, mentioned. “What appears to be like like a useful tutorial can truly be a refined cyber entice. The dimensions, modularity, and class of this community make it a blueprint for a way risk actors now weaponize engagement instruments to unfold malware.”

Using YouTube for malware distribution just isn’t a brand new phenomenon. For years, risk actors have been noticed hijacking reliable channels or utilizing newly created accounts to publish tutorial-style movies with descriptions pointing to malicious hyperlinks that, when clicked, result in malware.

These assaults are a part of a broader development the place attackers repurpose reliable platforms for nefarious functions, turning them into an efficient avenue for malware distribution. Whereas a number of the campaigns have abused reliable advert networks, resembling these related to search engines like google like Google or Bing, others have capitalized on GitHub as a supply car, as within the case of the Stargazers Ghost Community.

One of many most important the reason why Ghost Networks has taken off in a giant manner is that they can’t solely be used to amplify the perceived legitimacy of the hyperlinks shared, but in addition keep operational continuity even when the accounts are banned or taken down by the platform homeowners, due to their role-based construction.

“These accounts reap the benefits of varied platform options, resembling movies, descriptions, posts (a lesser-known YouTube characteristic just like Fb publish), and feedback to advertise malicious content material and distribute malware, whereas making a false sense of belief,” safety researcher Antonis Terefos mentioned.

“The vast majority of the community consists of compromised YouTube accounts, which, as soon as added, are assigned particular operational roles. This role-based construction allows stealthier distribution, as banned accounts could be quickly changed with out disrupting the general operation.”

There are three particular forms of accounts –

• Video-accounts, which add phishing movies and supply descriptions containing hyperlinks to obtain the marketed software program (alternatively, the hyperlinks are shared as a pinned remark or supplied straight within the video as a part of the set up course of)
• Put up-accounts, that are accountable for publishing neighborhood messages and posts containing hyperlinks to exterior websites
• Work together-accounts, which like and publish encouraging feedback to present the movies a veneer of belief and credibility

The hyperlinks direct customers to a variety of providers like MediaFire, Dropbox, or Google Drive, or phishing pages hosted on Google Websites, Blogger, and Telegraph that, in flip, incorporate hyperlinks to obtain the supposed software program. In lots of of those circumstances, the hyperlinks are hid utilizing URL shorteners to masks the true vacation spot.

A few of the malware households distributed by way of the YouTube Ghost Community embody Lumma Stealer, Rhadamanthys Stealer, StealC Stealer, RedLine Stealer, Phemedrone Stealer, and different Node.js-based loaders and downloaders –

• A channel named @Sound_Writer (9,690 subscribers), which has been compromised for over a yr to add cryptocurrency software program movies to deploy Rhadamanthys
• A channel named @Afonesio1 (129,000 subscribers), which was compromised on December 3, 2024, and January 5, 2025, to add a video promoting a cracked model of Adobe Photoshop to distribute an MSI installer that deploys Hijack Loader, which then delivers Rhadamanthys

“The continued evolution of malware distribution strategies demonstrates the outstanding adaptability and resourcefulness of risk actors in bypassing standard safety defenses,” Examine Level mentioned. “Adversaries are more and more shifting towards extra subtle, platform-based methods, most notably, the deployment of Ghost Networks.”

“These networks leverage the belief inherent in reliable accounts and the engagement mechanisms of fashionable platforms to orchestrate large-scale, persistent, and extremely efficient malware campaigns.”