Dissecting YouTube’s Malware Distribution Network

Check Point Research discovered and analyzed the "YouTube Ghost Network," a role-based collection of compromised YouTube accounts that systematically promoted cracked software and game cheats to distribute infostealer malware (primarily Lumma and Rhadamanthys). The investigation identified over 3,000 malicious videos (with substantial view counts), detailed operational tactics (video/post/interact account roles, password-protected archives, shortened/redirected links, redundant hosting), enumerated IOCs including hashes and C2 endpoints, and documented rapid malware/C2 rotation that enabled evasive, persistent campaigns; researchers reported the content to Google and provided detection/mitigation recommendations.