Loading threat actor…
YouTube Ghost Network is a malware distribution operation that abuses compromised YouTube accounts and coordinated bot activity to spread malicious software through video descriptions and related engagement. Active since at least 2021, the operation has used established hijacked accounts rather than newly created ones, and its activity volume increased significantly in 2025. The network has been observed organizing compromised accounts into functional roles, including accounts used to upload lure videos, accounts used to publish supporting posts and external download instructions, and accounts used to amplify trust through likes and positive comments. The operation primarily relies on social-engineering lures centered on game cheats, hacks, and pirated software, inducing victims to self-infect by downloading purported tools or cracked applications. Observed malware delivered through this ecosystem includes multiple infostealers and loaders, including Lumma, Rhadamanthys, StealC, RedLine, Odebug, Phemedrone variants, and Node.js-based loaders and downloaders such as GachiLoader. The actor’s tradecraft emphasizes broad-reach initial access through popular consumer-interest themes, combined with spoofed legitimacy created by account reputation and artificial engagement. Reporting indicates the model is evolving toward stealthier and potentially more targeted malware delivery, including possible adaptation of lures to enterprise or industry-specific software. Known aliases are limited to YouTube Ghost Network.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with a malware distribution campaign using a Node.js-based loader (GachiLoader) with heavy obfuscation and a previously undocumented PE injection technique; deploys a second-stage loader (Kidkadi) that abuses Vectored Exception Handling (VEH) via a technique dubbed 'Vectored Overloading' to load payloads.
A malware distribution operation leveraging compromised YouTube accounts (and other platforms like GitHub) plus bot-driven engagement to spread infostealers and other payloads via malicious links in video descriptions, commonly themed around game cheats/hacks and software cracks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.