Cyberattackers Hide Infostealers in YouTube Comments, Google Search Results

Trend Micro researchers report an ongoing criminal campaign that lures users searching for pirated or cracked software via weaponized YouTube videos and poisoned Google results; links in video descriptions and comments redirect to fake installer downloads hosted on reputable file‑sharing sites (e.g., Mediafire, Mega) that install infostealers (observed families include Lumma, PrivateLoader, MarsStealer, Amadey, Penguish, and Vidar) using evasive techniques such as password‑protected archives, shortened links, and large installer files to evade detection and sandboxing.