YouTube Ghost Malware Campaign: Over 3,000 Infected Videos Target Users

Check Point Research has uncovered a massive malware distribution operation called the YouTube Ghost Network, featuring over 3,000 malicious videos designed to infect users with information-stealing malware. The network has been operating since at least 2021, with activity tripling in 2025 as threat actors increasingly exploit YouTube’s trusted platform to bypass traditional security measures.

Researchers identified three distinct account types—video-accounts, post-accounts and interact-accounts—to upload content, share download links and create false legitimacy through engagement, enabling the campaign to persist even when individual accounts are banned. The operation targets users seeking “Game Hacks/Cheats” and “Software Cracks/Piracy,” with some videos, such as the one about Adobe Photoshop and another about FL Studio, attracting tens of thousands of views.

The majority of malware distributed comprises infostealers designed to exfiltrate credentials and financial data to remote C2 servers, with threat actors employing evasion techniques including password-protected archives and rapid C2 rotation every few days. According to a report, a compromised channel with 9,690 subscribers published content around cryptocurrency software and gaming, and the campaign’s archive suggests the operation began around 8 September. 24 October 2025.