YouTube Ghost Network

A cluster of malicious YouTube accounts has been exploiting the platform’s popularity to push malware to unsuspecting users. By mimicking legitimate tutorial and software‑crack content and leaning on engagement metrics, these actors turn what looks like helpful videos into infection vectors.

A Growing, Long‑Running Operation

Active since 2021, the campaign — now dubbed the YouTube Ghost Network by security researchers — has uploaded over 3,000 malicious videos. The volume surged this year, roughly tripling, which forced Google to remove the bulk of the offending material. Despite takedowns, the operation’s scale and modular design allow it to regenerate quickly.

How the Scheme Works: Trust as a Weapon

Attackers hijack legitimate channels or create new ones and replace or upload videos that advertise pirated applications, game cheats (notably Roblox cheats), or cracked software. These videos often appear as polished tutorials and use visible trust signals, high view counts, likes, and positive comments, to convince viewers the content is safe. Many infected videos have amassed hundreds of thousands of views (reported ranges: ~147k–293k), making the lure especially effective.

A Role‑Based, Resilient Infrastructure

The network’s strength comes from its role-driven structure: compromised accounts are assigned specific operational duties so the campaign can continue even when individual accounts are banned. This architecture helps maintain continuity and makes remediation more difficult.

Types of accounts observed include:

Video‑accounts: Upload bait videos and place download links in descriptions, pinned comments, or embedded in the video walkthrough.

Post‑accounts: Publish community posts or messages that link to external pages.

Interact‑accounts: Add likes and encouraging comments to manufacture social proof and legitimacy.

Delivery Chain: Where the Links Lead

Clickable links in video descriptions, comments, and posts redirect viewers to file‑hosting services (MediaFire, Dropbox, Google Drive) or to phishing/landing pages hosted on free platforms (Google Sites, Blogger, Telegraph). Frequently, those destinations use URL shorteners to obscure the final target, which often links to additional pages that ultimately deliver installers or loaders.

Malware Families and Loaders Observed

Researchers have tied the network to multiple information‑stealing families and Node.js‑based loaders and downloaders, such as:

Lumma Stealer, Rhadamanthys Stealer, StealC Stealer, RedLine Stealer, Phemedrone Stealer, plus various Node.js loaders.

Concrete Examples of Abuse

A channel called @Sound_Writer (approx. 9,690 subscribers) was compromised for more than a year and used to host cryptocurrency‑related videos that deployed Rhadamanthys.

Channel named @Afonesio1 (about 129,000 subscribers) was hijacked on December 3, 2024 and again on January 5, 2025 to post a video offering a cracked Adobe Photoshop; the distributed MSI delivered Hijack Loader, which in turn installed Rhadamanthys.

Why Ghost Networks Work So Well

These campaigns succeed because they repurpose the platform’s own engagement tools to signal legitimacy. The role‑based setup allows rapid account replacement and low operational churn, so even when platform owners remove content, the overall campaign survives. Ghost Networks are a clear example of how threat actors adapt by weaponizing normal social signals and platform features.

A Larger Trend: Platforms as Delivery Channels

YouTube isn’t unique in being abused — attackers have long used hijacked or newly created accounts to post tutorial‑style content that funnels victims to malicious links. Other legitimate services and ad networks (search engines, file hosts, code hosting sites like GitHub) have also been abused as part of distributed delivery chains (for example, the related Stargazers Ghost Network model).

What Security Teams and Users Should Do

Practical steps to reduce risk:

• Treat unsolicited 'cracked' software and cheat downloads as high risk; prefer vendor sites and official stores.
• Verify links outside the platform before downloading; avoid following shortened URLs without checking their destination.
• Harden detection for stealer families and Node.js loaders at the network and endpoint levels; monitor for suspicious downloading behavior from common file‑hosters.
• Educate users to distrust social‑proof cues (views, likes, comments) when they accompany software downloads.
• Remediate compromised channels by scanning for unusual uploads and rotating credentials, and enforce multifactor auth for creators.

Closing Note

The YouTube Ghost Network illustrates modern attackers’ fluency in blending social engineering with platform mechanics. Because the operation exploits trust signals and a modular account structure, defenders must combine user education, platform vigilance, and technical controls to interrupt the delivery chain and reduce the threat surface.