OfferLoader Campaign Uses YouTube and SEO Poisoning to Spread Malware

Palo Alto Networks’ Unit 42 researchers have identified more than 10,000 distinct OfferLoader malware samples in a pay-per-install operation active for at least two years. The suspected cybercrime syndicate, tracked as CL-CRI-1171, uses trojanised software installers promoted through 11 YouTube gaming channels and search-engine optimisation poisoning.

The channels reportedly have hundreds of thousands of subscribers and millions of views, while poisoned results lure users searching for tools such as Bluetooth drivers and disk-management utilities. The campaign is said to target gamers, enterprise workstations, critical infrastructure and government entities, although legal attribution remains unconfirmed.

OfferLoader acts as a delivery mechanism for multiple payloads. Its installer contacts a gate server that fingerprints visitors, reportedly showing benign decoys to automated scanners and malicious archives to selected users.

Once executed, it can launch three separate payload chains: Insomnia RAT, which establishes persistence through scheduled tasks and disables Windows Defender protections; ARKTunnel, which is hidden in bitmap images and communicates through WebSocket connections over TCP and UDP; and Docro Hijacker, which alters Chrome’s Secure Preferences file to change search providers and inject adverts across more than 190 search domains. Unit 42 says each stage can use separate command servers, allowing operators to change the delivered malware.

The researchers advise treating an OfferLoader detection as a potentially serious intrusion. Defenders should investigate unexpected Node.js or Python processes running from temporary directories, suspicious scheduled tasks, outbound WebSocket traffic and unauthorised changes to browser preference directories. Application allowlisting and installer-signature validation are also recommended.