YouTube Ghost Network Utilizes Spooky Tactics to Target Users

YouTube Ghost Network uses compromised accounts and bot networks to distribute infostealers, with threat actors targeting users by promising game hacks and cheats. In a Check Point Research investigation, the network was found to promote malicious links across videos, with at least 3,000 malicious videos on YouTube linked to the operation, most of which have since been taken down.

The group, active since 2021, has tripled its output in 2025 and relies on hijacked accounts to upload phishing content, post external download links, and engage with viewers to legitimise the content. Check Point researchers note that the operators distribute a range of malware families, including Lumma and Rhadamathys, via videos whose descriptions direct users to download supposedly legitimate software.

The researchers say the Ghost Network casts wide nets across the web and that users can essentially infect themselves by engaging with the content, underscoring the need for awareness and cybersecurity hygiene, according to the Check Point report published on 28 October 2025.