3,000 YouTube Videos Exposed as Malware Traps in Massive Ghost Network Operation

A cyber campaign described as the YouTube Ghost Network, named by Check Point, has published more than 3,000 malicious videos on YouTube since 2021, with the volume tripling since the start of the year. The network uses hacked YouTube accounts to replace legitimate content with videos centred on pirated software and Roblox game cheats that lead viewers to malware downloads.

Google has stepped in to remove a majority of these videos, but the operation relies on a modular, role-based structure that allows banned accounts to be rapidly replaced, sustaining persistence even when accounts are taken down. According to Check Point researchers, the attackers exploit trust signals such as views, likes, and comments to make malicious content appear legitimate, and some videos have garnered hundreds of thousands of views. The researchers note that this approach demonstrates the broader trend of weaponising engagement tools and platform trust to distribute malware at scale.