Dissecting YouTube’s Malware Distribution Network

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2025/youtube-ghost-network/
• Blog Title: Dissecting YouTube’s Malware Distribution Network
• Suggested Section: Generic Methodologies & Resources > Phishing Methodology > Platform Abuse (YouTube malware distribution TTPs) [cross-link to Basic Forensic Methodology > Specific Software/File-Type Tricks for MSI CustomAction analysis with lessmsi]

🎯 Content Summary

What CPR found
Check Point Research (CPR) analyzed the YouTube Ghost Network—a coordinated, role-based operation abusing YouTube features (video descriptions, pinned comments, Community posts, replies) to distribute malware at scale. CPR identified and reported >3,000 malicious videos. Activity has been steady since 2021 and has tripled in 2025. Primary payloads are infostealers (Lumma before its Mar–May 2025 disruption; now Rhadamanthys), plus StealC, RedLine, 0debug/Phemedrone va...

🔧 Technical Details

Ghost Network playbook (role separation + trust farming): Build a distributed operation in which compromised accounts have fixed roles—video uploaders seed/refresh links and reply to comments, post‑accounts publish Community posts with links/passwords, and interact‑accounts inflate trust via likes/positive comments. If a node is banned, others continue distribution with minimal disruption.

Platform feature abuse for link delivery: Place the external URL in the description, as a pinned comment, or reveal it during the video; mirror it via Community posts. Hide the destination behind shorteners and redirect to Google Sites/Blogspot/Telegraph pages that publish the password (e.g., 1337) and the final file‑sharing download.

Evasion by packaging and cadence: Ship password‑protected and/or oversized archives so engines cannot or will not scan contents; maintain redundant mirrors. Rebuild payloads and rotate C2s every 3–4 days so each sample/ho...

🤖 Agent Actions

Updates completed. Summary of actions:

What I added

1. New page: YouTube Platform Abuse for Malware Distribution

• Path: src/generic-methodologies-and-resources/phishing-methodology/youtube-platform-abuse-malware-distribution.md
• Content:
  • Role-separated “Ghost Network” model (video-accounts, post-accounts, interact-accounts)
  • Delivery TTPs using YouTube descriptions, pinned comments, Community posts, and replies
  • Redirect chains via shorteners → Google Sites/Blogspot/Telegraph → file-sharing (Dropbox/MediaFire/Drive)
  • Evasion by packaging: password-protected archives (commonly password 1337), oversized archives, redundant mirrors, rapid link/C2 rotation (3–4 days), and “disable Defender” social engineering message
  • Loader → stealer chain via MSI CustomAction with concrete lessmsi commands to extract files and tables (CustomAction, InstallExecuteSequence, File, Component, Binary)
  • Hunting/detection ideas: telemetry patterns for shorteners and trusted platforms, Defender-disable instructions, large archive downloads with rapid churn, and post-install stealer C2
  • Cross-links:
    • To the new MSI analysis page
    • To ZIPs tricks page for packaging/anti-reversing context
  • References: Check Point blog and lessmsi repo

2. New page: MSI Installer CustomAction Analysis

• Path: src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/msi-file-analysis-customaction.md
• Content:
  • Quick background on MSI tables (CustomAction, InstallExecuteSequence, File/Component, Binary)
  • lessmsi CLI usage for extraction and table listing; triage workflow to reconstruct EXE-based CustomAction chains and execution timing
  • Binary stream inspection guidance and msiexec verbose logging tip
  • Malicious MSI heuristics and a link back to the YouTube platform abuse page
  • References: lessmsi and the Check Point blog

3. Updated indexes and cross-links

• Phishing Methodology README (src/generic-methodologies-and-resources/phishing-methodology/README.md)
  • Added a new section “Platform Abuse – YouTube Malware Distribution” with a ref to the new page
• Specific Software/File Type Tricks README (src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/README.md)
  • Added a ref to the new MSI analysis page

Why these changes

• The repository didn’t have an actionable guide on YouTube platform abuse for malware distribution. The new page abstracts the TTPs from the referenced CPR research into concise, technical procedures and detection heuristics consistent with the existing Discord platform-abuse page style.
• There was no MSI-specific analysis page in “Specific Software/File-Type Tricks.” I added a focused MSI CustomAction triage guide using lessmsi that analysts can follow to reconstruct loader → stealer chains seen in the YouTube campaigns, and cross-linked it from the YouTube page.

References used

• Dissecting YouTube’s Malware Distribution Network (Check Point Research) https://research.checkpoint.com/2025/youtube-ghost-network/
• lessmsi – MSI extractor and table viewer https://github.com/activescott/lessmsi
• lessmsi Command-Line wiki https://github.com/activescott/lessmsi/wiki/Command-Line

Files created

• src/generic-methodologies-and-resources/phishing-methodology/youtube-platform-abuse-malware-distribution.md
• src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/msi-file-analysis-customaction.md

Files modified

• src/generic-methodologies-and-resources/phishing-methodology/README.md
• src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/README.md

No other changes were needed as these topics were not previously covered.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2025/youtube-ghost-network/

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Phishing Methodology > Platform Abuse (YouTube malware distribution TTPs) [cross-link to Basic Forensic Methodology > Specific Software/File-Type Tricks for MSI CustomAction analysis with lessmsi]".

Repository Maintenance:

• MD Files Formatting: 903 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0