YouTube Ghost Network: Massive Malware Distribution Operation

Check Point Research uncovered the YouTube Ghost Network, a sophisticated malware distribution operation featuring over 3,000 malicious videos. This network, active since 2021, tripled its activity in 2025, targeting users seeking game hacks, cheats, and software cracks. The network uses compromised accounts to upload malicious content, share download links, and create false legitimacy through positive comments. The most successful video targeted Adobe Photoshop, accumulating 293,000 views. The network primarily distributes infostealers like Rhadamanthys, adapting tactics to evade detection and maintain persistence. The operation highlights the evolving threat landscape where trusted platforms are exploited for malware distribution.