Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Gbhackers •Mayura Kathir • September 11, 2026

A long-running pay-per-install (PPI) operation that used YouTube gaming channels and SEO-poisoned software downloads to distribute malware at scale. The cluster, tracked as CL-CRI-1171, is linked to more than 10,000 distinct samples of a custom loader called OfferLoader, indicating a distribution pipeline far larger than the individual intrusions initially observed. Rather than relying on a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CL-CRI-1171 Cybercrime Operation Targets Gamers and Enterprises Unit 42 and Broadcom report on the CL-CRI-1171 cybercrime operation, a two-year scheme utilizing a pay-per-install marketplace to distribute malware targeting both young gamers and corporate networks. The operation leverages manipulated search engine results and popular gaming YouTube channels to deliver infections. The primary delivery mechanism, OfferLoader, has propagated three distinct malware strains: Insomnia RAT, ARKTunnel, and Docro Hijacker. The campaign has compromised numerous consumer systems and sensitive enterprise networks, with over 10,000 distinct loader samples identified. YouTube channels promoting gaming content were used as a delivery vehicle for malware, prompting their termination. The malware strains include a cross-platform backdoor, a WebSocket tunneling tool, and a browser-hijacking tool. Current protective measures include advanced URL filtering and DNS security from Palo Alto Networks and Symantec. The operation remains active, with ongoing risks for affected users. 4 sources 65

Extracted Entities

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

Tools (1)