Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign
Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.
66
Product
WinDirStat
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 9, 2026
- Last mentionedSep 11, 2026
Timeline
2 articles · newest firstUntracked Nightmares: The Threats Hiding Behind Commodity Infrastructure
Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.
47
Appears with
- Insomnia RATmalware · 2
- Socks5Systemzmalware · 2
- Unit 42vendor · 2
- Docro Hijackermalware · 2
- ARKTunnelmalware · 2
- CL-CRI-1171threat actor · 2
- Palo Alto Networksorganization · 2
- OfferLoadermalware · 1
- Microsoft Defenderproduct · 1
- Microsoftvendor · 1
- Google Chromeproduct · 1
- Googlevendor · 1
- Node.jsproduct · 1
- GCleanerproduct · 1
- YouTubevendor · 1
- Inno Setupproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.