YouTube Ghost Network: The New GachiLoader Malware Hiding in Your Favorite Video Links

A new Check Point Research investigation has revealed the YouTube Ghost Network, a campaign that weaponises a massive network of compromised YouTube accounts to spread a loader called GachiLoader behind seemingly innocent video links. The threat is targeted at users seeking cracked software or game cheats, exploiting the trust viewers place in established YouTube channels.

According to Check Point Research, GachiLoader is a Node.js loader that uses heavy obfuscation and acts as a bridge to deliver a final payload named Rhadamanthys, an information stealer designed to harvest credentials and other sensitive data. The campaign also deploys a second-stage component called Kidkadi, which uses a novel technique for Portable Executable injection by loading a legitimate DLL and abusing Vectored Exception Handling to replace it with a malicious payload.

Analysts note the attackers demonstrate Windows internals know-how with a new variation of a known technique, allowing the malware to operate under endpoint protection radar. Users are urged to be cautious of offers for cracked software or game cheats, which are often laced with malware.