3,000+ YouTube videos deliver malware disguised as free software

Hackers are using over 3,000 YouTube videos to distribute malware disguised as free software, game hacks, and cheat tools. This sophisticated operation, dubbed the "Ghost Network" by researchers, has been active since 2021 and saw a threefold increase in activity in 2025. Cybercriminals exploit users searching for "cracked" software or game cheats, leveraging compromised or fake YouTube accounts with fabricated comments and likes to create a false sense of legitimacy. Once a user clicks a malicious link, they are often directed to file-sharing services or phishing sites where they are prompted to download password-protected archives. Attackers further trick victims into disabling their antivirus software, clearing the path for information-stealing malware like Lumma Stealer, Rhadamanthys, StealC, and RedLine to harvest sensitive data. The network's resilience stems from its modular structure, where banned accounts are quickly replaced, and a role-based system for uploading, linking, and boosting content credibility. Two major campaigns highlighted by researchers involved the Rhadamanthys infostealer distributed via cryptocurrency videos and a... download the app to read more