Malware

Socks5Systemz

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 9, 2026 · last 4d ago

Timeline2 articles

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackersSep 11, 12:24 UTC · 4d agoMalware in the wild 2 sources2

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.

Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.

Palo Alto Unit 42updated Sep 11, 12:24 UTC · 4d agofirst Sep 9, 10:00 UTC · 6d agoMalware in the wild 2 sources1

Appears with

product WinDirStat 2 organization Palo Alto Networks 2 malware ARKTunnel 2 malware Insomnia RAT 2 malware Docro Hijacker 2 vendor Unit 42 2 threat actor CL-CRI-1171 2 product Inno Setup 1 product Microsoft Defender 1 product Node.js 1 product WinRAR 1 vendor Google 1 vendor Microsoft 1 vendor Palo Alto Networks 1 vendor YouTube 1 malware GCleaner 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.