Hackers are turning ordinary searches and gaming videos into malware traps. A long-running campaign used YouTube channels and search-engine manipulation to steer victims toward installers that looked like useful software, game tools or performance fixes.
The activity is tied to a pay-per-install operation known as CL-CRI-1171. This model gives other criminals a route into compromised machines, allowing unrelated malware to arrive through the same harmless download.
Unit 42 analysts identified the operation after investigating two low-priority infections at separate organizations. Their findings show how a loader resembling routine adware can hide a far broader delivery service, reaching gamers and corporate or government endpoints.
The scale is a central concern. Researchers found over 10,000 distinct samples of the shared OfferLoader component and 11 connected YouTube channels with vast audiences before the channels were removed.
Palo Alto Networks said in a report shared with Cyber Security News (CSN) that the visible infections are only a small part of the pipeline.
Hackers Abuse YouTube Gaming Channels and SEO Poisoning
The campaign used two different lures that fed the same infrastructure. Gaming channels published real advice about improving frame rates, fixing crashes, and changing settings, then encouraged viewers to download an alleged tool or optimization pack from links in video descriptions.
Those links often passed through Blogspot pages that direct victims onward. The approach follows a familiar pattern seen in YouTube malware delivery campaigns, where established-looking channels lend credibility to risky downloads and conceal the real destination behind several steps.
In parallel, search-engine optimization, or SEO, poisoning targeted people looking for legitimate utilities. A victim could search for a Bluetooth driver or WinDirStat, click a result, and land on a fake file-hosting page displaying a virus-scan animation before supplying a trojanized archive.
The campaign’s gate inspected a fresh click identifier with device, browser, search, referrer, and IP details. Genuine visitors received the installer, while automated scanners and researchers often saw a harmless WinRAR lookalike or a broken link.
Similar SEO poisoning software download traps show why search ranking is not proof that a download is genuine. OfferLoader used a trojanized Inno Setup installer to start the next stages.
After a tracking check, it launched three child processes for separate malware operations. This let the operator sell one infection to several buyers and swap payloads without rebuilding the lure.
RATs and Chrome Hijacker
One branch deployed Insomnia RAT, a dual Node.js and Python backdoor for Windows and macOS. Its installer disabled Microsoft Defender protections, added the whole C: drive to the exclusion list, and created scheduled tasks for persistence.
The backdoor can collect system identifiers, receive commands, download files, and report results to its controllers. A second branch installed ARKTunnel, an undocumented remote-access tool that hid its payload inside a bitmap image.
It created a delayed-start Windows service and could tunnel TCP or UDP traffic and run files. Hiding data in an image made the final payload less obvious in quick reviews.
The third branch, Docro Hijacker, altered Chrome’s protected preferences with valid integrity signatures. It changed the default search provider and side-loaded a browser extension that could rewrite requests, inject material into search-result pages, alter affiliate links, and redirect clicks.
The risk resembles malicious Chrome extension abuse, where trusted browsing is quietly reshaped for fraud or data collection. The practical lesson is to treat unexpected installers as a potential incident, not a minor nuisance.
Users should download applications only from verified publisher sites, avoid cracks and gaming cheats, and check a file’s publisher and signature before running it.
Organizations should investigate suspicious installer chains, unexpected scheduled tasks, new services, browser preference changes, and network connections to unfamiliar domains.
Teams responding to a suspected compromise should isolate the device, preserve evidence, reset exposed credentials from a clean system, and conduct a full review before returning it to use.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| SHA256 | 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c |
Trojanized windirstat.exe OfferLoader installer delivered through SEO poisoning |
| SHA256 | fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73 |
windirstat.tmp unpacked OfferLoader stage |
| SHA256 | 3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961 |
eld0.exe, Insomnia RAT initial loader |
| SHA256 | 25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5 |
eld0.tmp unpacked loader stage |
| SHA256 | 9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69 |
a.dll, PowerShell downloader for Insomnia RAT stages |
| SHA256 | ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e |
t.ps1, Insomnia RAT PowerShell loader |
| SHA256 | cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de |
Python component of the Insomnia RAT dual payload |
| SHA256 | 62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e |
aa.js, Node.js component of the Insomnia RAT dual payload |
| SHA256 | aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1 |
eld1.exe, ARKTunnel steganography dropper |
| SHA256 | e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d |
procorTrex.zip, archive extracted from the bitmap payload |
| SHA256 | b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c |
wscl.exe, ARKTunnel WebSocket tunneling RAT |
| SHA256 | d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf |
Resource icon shared across ARKTunnel samples |
| SHA256 | 06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5 |
Resource icon shared across ARKTunnel samples |
| SHA256 | 2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354 |
eld2.exe, Docro Hijacker branch installer |
| SHA256 | 553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104 |
eld2.tmp, unpacked Docro Hijacker stage |
| SHA256 | fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007 |
Adblock.dll, Chrome Secure Preferences bypass DLL |
| File name | windirstat.exe; windirstat.tmp; eld0.exe; eld0.tmp; a.dll; t.ps1; <guid>.py; aa.js |
OfferLoader and Insomnia RAT files |
| File name | eld1.exe; procorTrex.zip; wscl.exe |
ARKTunnel delivery and payload files |
| File name | eld2.exe; eld2.tmp; Adblock.dll |
Docro Hijacker installer and Chrome-hijacking components |
| File path | C:UsersPublicprocorTrex.zip |
ARKTunnel ZIP archive extraction location |
| File path | %TEMP%Adblock.dll |
Chrome preference-bypass DLL location |
| File path | C:ProgramDataDocsHelperdocro |
Docro Chrome extension installation path |
| URL | hxxps[:]//stryper[.]info/t.ps1 |
Stage-two PowerShell installer for Insomnia RAT |
| URL | hxxps[:]//stryper[.]info/aa.js |
Stage-three Node.js Insomnia RAT agent |
| URL | hxxp[:]//aa.amazingshield[.]xyz/33244556546.py |
Stage-three Python Insomnia RAT agent |
| URL | hxxps[:]//drelto[.]info/farlix |
Search-result injection script host |
| Domain | stryper[.]info; aa.amazingshield[.]xyz; crowdstri[.]com |
Insomnia RAT stage hosts and Python-agent C2 typosquat |
| Domain | reg.pcsdkflyer[.]ca |
ARKTunnel WebSocket RAT C2 server |
| Domain | vendralo[.]info; finersto[.]com; mqsearch[.]com; extentrack[.]com; drelto[.]info |
Docro Hijacker rule delivery, telemetry, search hijacking, callback, and script infrastructure |
| Domain | noiseship[.]cfd; atthelake[.]info; uy.basesfiles[.]com; basesfile[.]com; igk.filexspace[.]com; ikx.filexspace[.]com; filexstorage[.]site; filescloud[.]pro; zippyfiles[.]net; mifilesx[.]site; dw.xrsdownload[.]com; storage.ggclicker[.]com; watchadvance[.]com |
Initial-access SEO-poisoning and fake file-hosting infrastructure |
| Domain | voyagemist[.]space; statementtouch[.]xyz; chawton[.]info |
OfferLoader payload handoff and second-stage hosts |
| Domain | animalview[.]xyz; trickflag[.]info; suitstraw[.]info; connect.fuelleg[.]info; vesselsystem[.]xyz; minewave[.]info; collartitle[.]info; boardmagic[.]info; placespoon[.]xyz; needcherries[.]online |
OfferLoader installation-tracker infrastructure |
| Domain | velfps.blogspot[.]com; velvoxlab.blogspot[.]com; venrx.blogspot[.]com; venrxhub.blogspot[.]com; venrx[.]xyz; ravexoffical.blogspot[.]com; adex-blog.blogspot[.]com |
YouTube funnel burner blogs and custom-domain sites |
| YouTube channel | @VelvoxYT; @Venrx; @RAVEX-wu1pg; @adex915; @ripex; @hasnzyt; @OnTrendd; @trendrise; @Reknotic; @NowFixTutorials; @f4fix |
Channels linked to CL-CRI-1171 activity and subsequently taken down |
| Domain | achievershelf[.]space; activitymeal[.]space; additionplot[.]cfd; adviceturn[.]xyz; afternoonscrew[.]space; agreementjuice[.]space; airplaneiron[.]xyz; airtwig[.]xyz; amountfuel[.]icu; animalrecord[.]xyz; apparatustruck[.]xyz |
CL-CRI-1171 gate and landing infrastructure |
| Domain | apparelplate[.]space; archairport[.]xyz; authoritykittens[.]info; babyvein[.]xyz; badgewing[.]xyz; bagcare[.]space; basinpleasure[.]xyz; basketballyear[.]xyz; baskethumor[.]xyz; bedroomdesire[.]xyz; beliefpicture[.]xyz; bellplayground[.]xyz; bikesdonkey[.]info; birthdaymagic[.]xyz; boatthought[.]xyz; boundarychickens[.]xyz; boytank[.]xyz; branchmorning[.]xyz; breathdoctor[.]xyz; bubbleslip[.]xyz; cabbagemeasure[.]xyz; cablecanvas[.]xyz; cardgrape[.]xyz; cattlegold[.]xyz; celeryerror[.]xyz; centscarf[.]xyz |
CL-CRI-1171 gate and landing infrastructure |
| Domain | chalkprose[.]xyz; cherriestruck[.]space; chesstail[.]xyz; chickensmine[.]space; churchpail[.]xyz; clothcrib[.]xyz; clothcurrent[.]xyz; coatberry[.]xyz |
CL-CRI-1171 gate and landing infrastructure |
| Domain | connect.activitykitty[.]xyz; connect.apparatustaste[.]xyz; connect.armcard[.]xyz; connect.badgeterritory[.]xyz; connect.baitmetal[.]xyz; connect.beefteeth[.]xyz; connect.believesisters[.]xyz; connect.boundaryfly[.]xyz; connect.bubbleappliance[.]xyz; connect.cableland[.]xyz; connect.chinexpert[.]xyz; connect.conditiongrade[.]xyz; connect.coppersummer[.]xyz; connect.creatorcreator[.]xyz; connect.dresstent[.]xyz; connect.dropjeans[.]xyz; connect.edgeplayground[.]xyz; connect.exchangeclub[.]xyz |
CL-CRI-1171 installation-tracker infrastructure |
| Domain | connect.existencediscussion[.]info; connect.expansionsalt[.]info; connect.fangstitch[.]xyz; connect.fogparcel[.]info; connect.foodhook[.]info; connect.forkcountry[.]xyz; connect.geesepurpose[.]xyz; connect.giantsdogs[.]info; connect.giraffetoothpaste[.]xyz; connect.guitarrobin[.]xyz; connect.halllunch[.]info; connect.harborclam[.]xyz; connect.holecompany[.]info; connect.knifesea[.]icu; connect.monthsmoke[.]info; connect.nosegovernor[.]xyz; connect.pagesubstance[.]xyz; connect.poisonblade[.]xyz; connect.prosesalt[.]xyz; connect.purposethings[.]info; connect.quiltgirls[.]xyz; connect.reactionbit[.]info; connect.rewardrun[.]xyz; connect.riceapparel[.]xyz; connect.seashoreletters[.]info; connect.selectiondogs[.]xyz |
CL-CRI-1171 installation-tracker infrastructure |
| Domain | connect.shapeboot[.]info; connect.shoptax[.]xyz; connect.stopfinger[.]info; connect.structurekiss[.]xyz; connect.tanksuggestion[.]xyz; connect.thingbrass[.]xyz; connect.thoughtslave[.]xyz; connect.threadfuel[.]xyz; connect.trailcontrol[.]xyz; connect.trickbushes[.]info; connect.vacationthought[.]xyz; connect.viewschool[.]xyz; connect.voyagelaugh[.]xyz; connect.woolreward[.]xyz; connect.yearicicle[.]xyz; connect.zebratransport[.]xyz |
CL-CRI-1171 installation-tracker infrastructure |
| Domain | controlprice[.]xyz; coughcoal[.]icu; countrypipe[.]space; cowsfoot[.]xyz; crackfood[.]space; creamfurniture[.]space; creditchickens[.]xyz; crediteducation[.]cfd; crimestreet[.]xyz; crimesupport[.]cfd; curvebite[.]xyz; deathrock[.]xyz; deathshop[.]xyz; decisionreaction[.]xyz; dinosaursjam[.]cfd; distancebedroom[.]xyz; distributiontheory[.]cfd; dolldebt[.]xyz; doorsoap[.]cfd; dustprotest[.]icu; expansionsalt[.]info; fallbeginner[.]xyz; fangbear[.]xyz |
CL-CRI-1171 gate and landing infrastructure |
| Domain | filescenter[.]cloud; filesilo[.]cloud; fingerbasketball[.]xyz; flavorwood[.]xyz; fleshfrog[.]xyz; fleshplants[.]xyz; fleshproduce[.]xyz; foodrock[.]space; forkmice[.]xyz; friendjewel[.]cfd; geeseairport[.]xyz; girlsgrain[.]xyz; glassmove[.]xyz; goldsteel[.]cfd; governmentyard[.]cfd; grandfatherquiver[.]xyz; gripcollar[.]xyz; gripsleep[.]xyz; gunbear[.]xyz; hairreward[.]xyz; hatescale[.]info; healthiron[.]space; holemuscle[.]xyz; homecub[.]cfd; homefireman[.]xyz; honeyfear[.]xyz |
CL-CRI-1171 gate and landing infrastructure |
| Domain | ilesilo[.]cloud; instrumentvolcano[.]space; kittenschalk[.]xyz; kittensgrade[.]cfd; kittensrobin[.]info; landerror[.]xyz; lesilo[.]cloud; liptendency[.]info; liquidtoes[.]xyz; liquidwrench[.]cfd; lockettrail[.]xyz; lumberbaseball[.]xyz; memorycompany[.]xyz; micesisters[.]xyz; milkname[.]xyz; minuteblade[.]xyz; mountainsurprise[.]cfd; mouthfruit[.]cfd; northbox[.]xyz; partpipe[.]xyz; partyfriends[.]cfd; passengerbrake[.]space; peacejewel[.]xyz; peacetongue[.]xyz; petminister[.]xyz; pictureporter[.]cfd |
CL-CRI-1171 gate and landing infrastructure |
| Domain | pieplant[.]space; pizzasthread[.]xyz; pleasurewaves[.]info; popcornregret[.]xyz; porterdebt[.]xyz; powerbushes[.]xyz; profitfact[.]xyz; prosetoothbrush[.]xyz; quincepage[.]xyz; raintexture[.]xyz; rakepurpose[.]xyz; raterake[.]cfd; readingscience[.]xyz; reasonachiever[.]xyz; recessgiraffe[.]xyz; recordhistory[.]xyz; regretsquirrel[.]xyz; restbucket[.]xyz; ricestar[.]xyz; rifledog[.]xyz; ringsparcel[.]xyz; roadyear[.]xyz; rockcredit[.]space; rollglass[.]xyz; roofbattle[.]xyz; roofreaction[.]xyz |
CL-CRI-1171 gate and landing infrastructure |
| Domain | rosegrip[.]xyz; routeletters[.]xyz; runhouses[.]xyz; scarecrowcare[.]xyz; scentrod[.]info; screwbirth[.]xyz; seatlace[.]space; seaword[.]xyz; servantadvice[.]xyz; shiptank[.]cfd; shirtexample[.]xyz; shoesearthquake[.]xyz; sinkwash[.]space; skirtloss[.]xyz; slipvegetable[.]xyz; smokecar[.]space; songtheory[.]xyz; spadeleg[.]xyz; sparkrice[.]space; sparkrub[.]xyz; spoonducks[.]cfd; springdogs[.]xyz; spybaseball[.]space; startmonkey[.]cfd; statementservant[.]xyz; steamhouses[.]cfd |
CL-CRI-1171 gate and landing infrastructure |
| Domain | stopzinc[.]xyz; structurelinen[.]xyz; suggestioncemetery[.]xyz; suitsoap[.]xyz; swimrest[.]xyz; tablechess[.]info; tailsilk[.]xyz; territorycaption[.]xyz; texturebadge[.]xyz; thrillducks[.]xyz; throneback[.]xyz; tinsofa[.]xyz; toespiders[.]xyz; toothpastesense[.]xyz; toothpastesun[.]xyz; townquiver[.]xyz; trampdonkey[.]icu; treesboard[.]xyz; truckpig[.]cfd; truckshat[.]xyz; turnclass[.]xyz; umbrellavessel[.]xyz; vacationengine[.]xyz; vestthings[.]cfd; volcanopin[.]xyz |
CL-CRI-1171 gate and landing infrastructure |
| Domain | wastereading[.]xyz; wasteturkey[.]xyz; wastewine[.]xyz; wavepan[.]xyz; whistlebook[.]cfd; whistlesong[.]xyz; wormspark[.]xyz; woundsecretary[.]xyz; wrenobservation[.]xyz; yamsmell[.]xyz; yardvalue[.]cfd; zephyrhall[.]cfd |
CL-CRI-1171 gate and landing infrastructure |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
The post Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker appeared first on Cyber Security News.