CL-CRI-1171

Mentions · 7d0
Mentions · 30d0
All mentions3
First seenSep 9, 2026
Last mentionedSep 17, 2026

Timeline

3 articles · newest first

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.

The Hacker NewsSep 17, 17:32 UTC · Sep 17, 2026Threat actorExploitedCVE-2026-593101

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

GBHackersSep 11, 12:24 UTC · Sep 11, 2026MalwareExploited6 · 2 reads

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.

Palo Alto Unit 42Sep 9, 10:00 UTC · Sep 9, 2026MalwareExploited4 · 2 reads

Related CVEs

by mentions

CVE-2026-593103%9.8
Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
published Jul 30, 2026Broadcom (VMware) vCenter ServerKEVRansomwarePoC ×2

Appears with

Socks5Systemzmalware · 3
ARKTunnelmalware · 3
Unit 42vendor · 3
Insomnia RATmalware · 3
Docro Hijackermalware · 3
Palo Alto Networksorganization · 2
Palo Alto Networksvendor · 2
GCleanermalware · 2
WinDirStatproduct · 2
OfferLoadermalware · 2
vCenterproduct · 1
GCleanerproduct · 1
YouTubevendor · 1
Inno Setupproduct · 1
VMwarevendor · 1
Microsoft Defenderproduct · 1

Entities are extracted by the model from each article. First seen Sep 9, 2026, last mentioned Sep 17, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.