Cracked Software and YouTube Videos Spread CountLoader and GachiLoader Malware

Cybersecurity researchers have detailed a campaign that uses cracked software distribution sites as a delivery vector for CountLoader, a modular loader that Cyderes Howler Cell Threat Intelligence team says acts as the initial tool in a multistage attack for access, evasion, and delivery of additional malware families. CountLoader has previously been documented pushing payloads such as Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and PureMiner, and has been detected in the wild since at least June 2025.

The latest chain begins when users download cracked Microsoft Word, redirected to a MediaFire link hosting a malicious ZIP containing an encrypted archive and a password-protected second archive, with a renamed Setup.exe that retrieves CountLoader 3.2 via mshta.exe. To establish persistence it creates a scheduled task named GoogleTaskSystem136.0.7023.12 and checks for CrowdStrike Falcon via WMI; if detected, the command is tweaked, otherwise it directly calls the URL with mshta.exe.

The campaign also highlights CountLoader’s ability to download and execute various payloads and exfiltrate system information, and the final payload observed is an information stealer known as ACR Stealer.

Meanwhile, a separate GachiLoader campaign distributed via the YouTube Ghost Network, described by Check Point, uses a Node.js loader to deploy second-stage malware such as Kidkadi and employs PE injection via Vectored Exception Handling, with up to 100 YouTube videos implicated and around 220,000 views; the first video dates to 22 December 2024. According to Check Point, GachiLoader can also kill SecHealthUI.exe and configure Defender exclusions to evade detection.