YouTube Ghost Network Exposed: Coordinated Channels Spread Infostealer Malware via Game/Software Cracks

According to Check Point Research, the YouTube Ghost Network is a sophisticated, coordinated campaign on YouTube that weaponises fake and compromised accounts to spread information-stealing malware and manipulate viewer trust. Active since 2021 but sharply escalating in 2025, CPR reports that over 3,000 malicious videos were identified, many removed by YouTube, with the content targeting Game Hacks/Cheats and Software Cracks/Piracy.

The network’s structure is modular and role-based, with video accounts hosting content, post accounts sharing links and passwords, and interact accounts adding fake engagement to appear trustworthy, enabling rapid replacement of banned accounts. Check Point notes that Lumma was the most frequently distributed infostealer from 2024 until its disruption between March and May 2025, after which Rhadamanthys became the preferred infostealer, alongside other families such as StealC, RedLine and Phemedrone variants.

In documented campaigns, compromised channels with thousands of subscribers hosted malware installers—one MSI installer on Dropbox delivered HijackLoader, which deployed Rhadamanthys v0.9.2 contacting a C2 at 94.74.164[.{]}157:8888/gateway/6xomjoww.1hj7n. The researchers also observed phishing pages encouraging users to disable Windows Defender temporarily and noted two primary victim demographics: gamers and creative professionals.