OfferLoader

Mentions · 7d0
Mentions · 30d0
All mentions2
First seenSep 11, 2026
Last mentionedSep 17, 2026

Timeline

2 articles · newest first

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.

The Hacker NewsSep 17, 17:32 UTC · Sep 17, 2026Threat actorExploitedCVE-2026-593101

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

GBHackersSep 11, 12:24 UTC · Sep 11, 2026MalwareExploited6 · 2 reads

Related CVEs

by mentions

CVE-2026-593103%9.8
Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
published Jul 30, 2026Broadcom (VMware) vCenter ServerKEVRansomwarePoC ×2

Appears with

Docro Hijackermalware · 2
Unit 42vendor · 2
ARKTunnelmalware · 2
CL-CRI-1171threat actor · 2
Socks5Systemzmalware · 2
Insomnia RATmalware · 2
GCleanermalware · 2
LocalAIproduct · 1
Oasis Securityvendor · 1
Microsoft Defenderproduct · 1
Irregularorganization · 1
Oraclevendor · 1
Microsoftvendor · 1
Google Chromeproduct · 1
WinDirStatproduct · 1
Googlevendor · 1

Entities are extracted by the model from each article. First seen Sep 11, 2026, last mentioned Sep 17, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.