Skip to content
YouTube Ghost Network Distributes Malware via Compromised Accounts

YouTube Ghost Network Distributes Malware via Compromised Accounts

First seen 2 Dec 2025, 18:33 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster March 12, 2026 at 13:27 UTC

In 2025, Check Point Research identified a malware distribution network on YouTube, dubbed the 'YouTube Ghost Network.' This operation utilized compromised accounts and social engineering tactics to spread information-stealing malware disguised as free software, affecting users seeking legitimate content. Google has since removed over 3,000 videos linked to this malicious activity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 182d ago How this analysis works

More articles in this cluster (3)

Following this threat?

Track Lumma and YouTube in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed