Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign
Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.
Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.
- OfferLoader embedded in trojanized Inno Setup installers delivered multiple malware families per infection
- 11 YouTube gaming channels used as distribution, later terminated after notification
- Insomnia RAT disabled Microsoft Defender and created scheduled tasks masquerading as Windows components
- ARKTunnel used least-significant-bit steganography to extract payloads from bitmap images
- Docro Hijacker bypassed Chrome's HMAC-SHA256 Secure Preferences integrity check
- ATT&CK
- T1204.002 Malicious FileT1562.001 Impair DefensesT1053.005 Scheduled TaskT1027.003 SteganographyT1036.005 Match Legitimate Name or Location
- Threat actors
- CL-CRI-1171
- Organizations
- Palo Alto Networks
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c | look ordinary. IOCs SHA-256 File Name File Type Description 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c windirstat.exe PE32 executable; Inno Setup 6.7.1 installer |
| sha256 | fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73 | at installer distributed through an SEO-poisoning campaign. fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73 windirstat.tmp PE32 executable; unpacked Inno Setup stage U |
From the original article
4 min read at gbhackers.com
A long-running pay-per-install (PPI) operation that used YouTube gaming channels and SEO-poisoned software downloads to distribute malware at scale. The cluster, tracked as CL-CRI-1171, is linked to more than 10,000 distinct samples of a custom loader called OfferLoader, indicating a distribution pipeline far larger than the individual intrusions initially observed. Rather than relying on a […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.