Dissecting YouTube’s Malware Distribution Network

The YouTube Ghost Network is a coordinated group of malicious accounts on YouTube that promotes phishing pages and malware, relying on likes, comments and trust to push dangerous content, according to Check Point Research. The investigation identified more than 3,000 malicious videos linked to the network, with the bulk of these being removed but the activity having apparently started around 2021 and continuing into 2025, when the volume of such videos has tripled.

The network targets the Game Hacks/Cheats and Software Cracks/Piracy categories, and the most viewed malspam in the dataset promotes cracked software such as Adobe Photoshop, which attracted 293,000 views and 54 comments. Lumma was the most frequently distributed infostealer prior to its disruption between March and May 2025, after which Rhadamanthys became the preferred infostealer, with campaigns using compromised accounts such as @Sound_Writer.

The researchers describe a modular, role-based operation that includes video-accounts, post-accounts and interact-accounts, employing password‑protected archives, multiple hosting platforms and rapid payload updates to evade detection and sustain distribution.