OfferLoader network spreads malware through YouTube searches

Security researchers have mapped a pay-per-install malware operation using YouTube gaming channels and poisoned search results to distribute more than 10,000 distinct samples of a custom loader, exposing a cybercrime delivery network operating at substantial scale.

Palo Alto Networks’ Unit 42 said the activity, tracked as CL-CRI-1171, funnels victims through two main routes: gaming-related YouTube content and search-engine optimisation poisoning that steers users towards trojanised software downloads. Both routes ultimately lead to the same pay-per-install infrastructure, where OfferLoader installs payloads chosen by separate malware operators.

The researchers identified more than 10,000 unique OfferLoader samples, a figure they said points to a distribution pipeline far broader than the individual compromises that first drew attention to the activity. The operation has been active for at least two years, while payload tracking showed some malware combinations rotating between July 2025 and April 2026.

Unit 42 linked at least 11 YouTube channels to the gaming funnel. The channels published videos promising fixes for crashes, higher frame rates and other performance improvements, directing viewers to downloads presented as tools or optimisation packages. The channels had amassed hundreds of thousands of subscribers and millions of views before being reported to YouTube, which terminated those identified by the researchers.

A parallel SEO-poisoning route targeted people searching for legitimate utilities, drivers, cracked applications and gaming software. Researchers observed victims being sent to file-hosting lure pages that displayed fake virus-scan animations before delivering compressed archives through several redirects and into the pay-per-install gate.

Unit 42 said the SEO route reached corporate endpoints, including systems in critical infrastructure and government entities, demonstrating that a campaign promoted partly through gaming content was not confined to consumer machines. The researchers described the infections they investigated as only a small sample of the activity, because each OfferLoader variant could be configured to deliver a different combination of payloads.

The infrastructure used more than 200 rotating hostnames with a recurring two-word naming pattern across domains including. xyz,. cfd,. space and. info, according to Unit 42. The shared domains, loader code and traffic-routing mechanisms helped investigators connect what initially appeared to be separate malware incidents.

OfferLoader was packaged inside trojanised Inno Setup installers. During one observed infection involving a fake WinDirStat package, the loader unpacked a temporary component and contacted a tracking domain. Its response determined whether the installation stopped or proceeded, after which the loader launched several child processes carrying affiliate parameters that tied installations to particular malware campaigns.

That structure reflects the economics of pay-per-install services, where one operator supplies access to infected machines while other criminal customers pay to deploy their own malware. The loader itself can appear generic or disposable, while the payloads placed on a compromised device may differ in purpose, infrastructure and ownership.

Three malware families were examined in detail from two intrusion sets observed in April. They included Insomnia RAT, a dual-agent backdoor using Node. js and Python components; ARKTunnel, a previously undocumented WebSocket tunnelling tool concealed inside a bitmap image using steganography; and Docro Hijacker, a Chrome-focused backdoor designed to manipulate browser behaviour.

Insomnia RAT was built to operate across Windows and macOS and used separate runtime environments to maintain access. ARKTunnel created a tunnelling capability that could give operators a pathway into infected systems, while Docro Hijacker revived an older browser-hijacking technique adapted to bypass newer Chrome integrity controls.

A separate infection observed in June delivered two different payloads, GCleaner and Socks5Systemz, reinforcing the researchers’ assessment that OfferLoader functions as a general distribution mechanism rather than a loader tied to one malware family.

The investigation began after two unrelated organisations experienced infections involving different software lures, including a Bluetooth driver and a WinDirStat installer. Both systems subsequently executed an identical chain, leading researchers to pivot from the loader’s command-and-control infrastructure and uncover the larger network.