Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker

Hackers are turning ordinary searches and gaming videos into malware traps. A long-running campaign used YouTube channels and search-engine manipulation to steer victims toward installers that looked like useful software, game tools or performance fixes.

The activity is tied to a pay-per-install operation known as CL-CRI-1171. This model gives other criminals a route into compromised machines, allowing unrelated malware to arrive through the same harmless download.

Unit 42 analysts identified the operation after investigating two low-priority infections at separate organizations. Their findings show how a loader resembling routine adware can hide a far broader delivery service, reaching gamers and corporate or government endpoints.

The scale is a central concern. Researchers found over 10,000 distinct samples of the shared OfferLoader component and 11 connected YouTube channels with vast audiences before the channels were removed.

Palo Alto Networks said in a report shared with Cyber Security News (CSN) that the visible infections are only a small part of the pipeline.

Hackers Abuse YouTube Gaming Channels and SEO Poisoning

The campaign used two different lures that fed the same infrastructure. Gaming channels published real advice about improving frame rates, fixing crashes, and changing settings, then encouraged viewers to download an alleged tool or optimization pack from links in video descriptions.

Those links often passed through Blogspot pages that direct victims onward. The approach follows a familiar pattern seen in YouTube malware delivery campaigns, where established-looking channels lend credibility to risky downloads and conceal the real destination behind several steps.

In parallel, search-engine optimization, or SEO, poisoning targeted people looking for legitimate utilities. A victim could search for a Bluetooth driver or WinDirStat, click a result, and land on a fake file-hosting page displaying a virus-scan animation before supplying a trojanized archive.

The campaign’s gate inspected a fresh click identifier with device, browser, search, referrer, and IP details. Genuine visitors received the installer, while automated scanners and researchers often saw a harmless WinRAR lookalike or a broken link.

Similar SEO poisoning software download traps show why search ranking is not proof that a download is genuine. OfferLoader used a trojanized Inno Setup installer to start the next stages.

After a tracking check, it launched three child processes for separate malware operations. This let the operator sell one infection to several buyers and swap payloads without rebuilding the lure.

RATs and Chrome Hijacker

One branch deployed Insomnia RAT, a dual Node.js and Python backdoor for Windows and macOS. Its installer disabled Microsoft Defender protections, added the whole C: drive to the exclusion list, and created scheduled tasks for persistence.

The backdoor can collect system identifiers, receive commands, download files, and report results to its controllers. A second branch installed ARKTunnel, an undocumented remote-access tool that hid its payload inside a bitmap image.

It created a delayed-start Windows service and could tunnel TCP or UDP traffic and run files. Hiding data in an image made the final payload less obvious in quick reviews.

The third branch, Docro Hijacker, altered Chrome’s protected preferences with valid integrity signatures. It changed the default search provider and side-loaded a browser extension that could rewrite requests, inject material into search-result pages, alter affiliate links, and redirect clicks.

The risk resembles malicious Chrome extension abuse, where trusted browsing is quietly reshaped for fraud or data collection. The practical lesson is to treat unexpected installers as a potential incident, not a minor nuisance.

Users should download applications only from verified publisher sites, avoid cracks and gaming cheats, and check a file’s publisher and signature before running it.

Organizations should investigate suspicious installer chains, unexpected scheduled tasks, new services, browser preference changes, and network connections to unfamiliar domains.

Teams responding to a suspected compromise should isolate the device, preserve evidence, reset exposed credentials from a clean system, and conduct a full review before returning it to use.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA256	7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c	Trojanized windirstat.exe OfferLoader installer delivered through SEO poisoning
SHA256	fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73	windirstat.tmp unpacked OfferLoader stage
SHA256	3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961	eld0.exe, Insomnia RAT initial loader
SHA256	25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5	eld0.tmp unpacked loader stage
SHA256	9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69	a.dll, PowerShell downloader for Insomnia RAT stages
SHA256	ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e	t.ps1, Insomnia RAT PowerShell loader
SHA256	cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de	Python component of the Insomnia RAT dual payload
SHA256	62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e	aa.js, Node.js component of the Insomnia RAT dual payload
SHA256	aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1	eld1.exe, ARKTunnel steganography dropper
SHA256	e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d	procorTrex.zip, archive extracted from the bitmap payload
SHA256	b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c	wscl.exe, ARKTunnel WebSocket tunneling RAT
SHA256	d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf	Resource icon shared across ARKTunnel samples
SHA256	06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5	Resource icon shared across ARKTunnel samples
SHA256	2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354	eld2.exe, Docro Hijacker branch installer
SHA256	553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104	eld2.tmp, unpacked Docro Hijacker stage
SHA256	fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007	Adblock.dll, Chrome Secure Preferences bypass DLL
File name	windirstat.exe; windirstat.tmp; eld0.exe; eld0.tmp; a.dll; t.ps1; <guid>.py; aa.js	OfferLoader and Insomnia RAT files
File name	eld1.exe; procorTrex.zip; wscl.exe	ARKTunnel delivery and payload files
File name	eld2.exe; eld2.tmp; Adblock.dll	Docro Hijacker installer and Chrome-hijacking components
File path	C:\Users\Public\procorTrex.zip	ARKTunnel ZIP archive extraction location
File path	%TEMP%\Adblock.dll	Chrome preference-bypass DLL location
File path	C:\ProgramData\DocsHelper\docro\	Docro Chrome extension installation path
URL	hxxps[:]//stryper[.]info/t.ps1	Stage-two PowerShell installer for Insomnia RAT
URL	hxxps[:]//stryper[.]info/aa.js	Stage-three Node.js Insomnia RAT agent
URL	hxxp[:]//aa.amazingshield[.]xyz/33244556546.py	Stage-three Python Insomnia RAT agent
URL	hxxps[:]//drelto[.]info/farlix	Search-result injection script host
Domain	stryper[.]info; aa.amazingshield[.]xyz; crowdstri[.]com	Insomnia RAT stage hosts and Python-agent C2 typosquat
Domain	reg.pcsdkflyer[.]ca	ARKTunnel WebSocket RAT C2 server
Domain	vendralo[.]info; finersto[.]com; mqsearch[.]com; extentrack[.]com; drelto[.]info	Docro Hijacker rule delivery, telemetry, search hijacking, callback, and script infrastructure
Domain	noiseship[.]cfd; atthelake[.]info; uy.basesfiles[.]com; basesfile[.]com; igk.filexspace[.]com; ikx.filexspace[.]com; filexstorage[.]site; filescloud[.]pro; zippyfiles[.]net; mifilesx[.]site; dw.xrsdownload[.]com; storage.ggclicker[.]com; watchadvance[.]com	Initial-access SEO-poisoning and fake file-hosting infrastructure
Domain	voyagemist[.]space; statementtouch[.]xyz; chawton[.]info	OfferLoader payload handoff and second-stage hosts
Domain	animalview[.]xyz; trickflag[.]info; suitstraw[.]info; connect.fuelleg[.]info; vesselsystem[.]xyz; minewave[.]info; collartitle[.]info; boardmagic[.]info; placespoon[.]xyz; needcherries[.]online	OfferLoader installation-tracker infrastructure
Domain	velfps.blogspot[.]com; velvoxlab.blogspot[.]com; venrx.blogspot[.]com; venrxhub.blogspot[.]com; venrx[.]xyz; ravexoffical.blogspot[.]com; adex-blog.blogspot[.]com	YouTube funnel burner blogs and custom-domain sites
YouTube channel	@VelvoxYT; @Venrx; @RAVEX-wu1pg; @adex915; @ripex; @hasnzyt; @OnTrendd; @trendrise; @Reknotic; @NowFixTutorials; @f4fix	Channels linked to CL-CRI-1171 activity and subsequently taken down
Domain	achievershelf[.]space; activitymeal[.]space; additionplot[.]cfd; adviceturn[.]xyz; afternoonscrew[.]space; agreementjuice[.]space; airplaneiron[.]xyz; airtwig[.]xyz; amountfuel[.]icu; animalrecord[.]xyz; apparatustruck[.]xyz	CL-CRI-1171 gate and landing infrastructure
Domain	apparelplate[.]space; archairport[.]xyz; authoritykittens[.]info; babyvein[.]xyz; badgewing[.]xyz; bagcare[.]space; basinpleasure[.]xyz; basketballyear[.]xyz; baskethumor[.]xyz; bedroomdesire[.]xyz; beliefpicture[.]xyz; bellplayground[.]xyz; bikesdonkey[.]info; birthdaymagic[.]xyz; boatthought[.]xyz; boundarychickens[.]xyz; boytank[.]xyz; branchmorning[.]xyz; breathdoctor[.]xyz; bubbleslip[.]xyz; cabbagemeasure[.]xyz; cablecanvas[.]xyz; cardgrape[.]xyz; cattlegold[.]xyz; celeryerror[.]xyz; centscarf[.]xyz	CL-CRI-1171 gate and landing infrastructure
Domain	chalkprose[.]xyz; cherriestruck[.]space; chesstail[.]xyz; chickensmine[.]space; churchpail[.]xyz; clothcrib[.]xyz; clothcurrent[.]xyz; coatberry[.]xyz	CL-CRI-1171 gate and landing infrastructure
Domain	connect.activitykitty[.]xyz; connect.apparatustaste[.]xyz; connect.armcard[.]xyz; connect.badgeterritory[.]xyz; connect.baitmetal[.]xyz; connect.beefteeth[.]xyz; connect.believesisters[.]xyz; connect.boundaryfly[.]xyz; connect.bubbleappliance[.]xyz; connect.cableland[.]xyz; connect.chinexpert[.]xyz; connect.conditiongrade[.]xyz; connect.coppersummer[.]xyz; connect.creatorcreator[.]xyz; connect.dresstent[.]xyz; connect.dropjeans[.]xyz; connect.edgeplayground[.]xyz; connect.exchangeclub[.]xyz	CL-CRI-1171 installation-tracker infrastructure
Domain	connect.existencediscussion[.]info; connect.expansionsalt[.]info; connect.fangstitch[.]xyz; connect.fogparcel[.]info; connect.foodhook[.]info; connect.forkcountry[.]xyz; connect.geesepurpose[.]xyz; connect.giantsdogs[.]info; connect.giraffetoothpaste[.]xyz; connect.guitarrobin[.]xyz; connect.halllunch[.]info; connect.harborclam[.]xyz; connect.holecompany[.]info; connect.knifesea[.]icu; connect.monthsmoke[.]info; connect.nosegovernor[.]xyz; connect.pagesubstance[.]xyz; connect.poisonblade[.]xyz; connect.prosesalt[.]xyz; connect.purposethings[.]info; connect.quiltgirls[.]xyz; connect.reactionbit[.]info; connect.rewardrun[.]xyz; connect.riceapparel[.]xyz; connect.seashoreletters[.]info; connect.selectiondogs[.]xyz	CL-CRI-1171 installation-tracker infrastructure
Domain	connect.shapeboot[.]info; connect.shoptax[.]xyz; connect.stopfinger[.]info; connect.structurekiss[.]xyz; connect.tanksuggestion[.]xyz; connect.thingbrass[.]xyz; connect.thoughtslave[.]xyz; connect.threadfuel[.]xyz; connect.trailcontrol[.]xyz; connect.trickbushes[.]info; connect.vacationthought[.]xyz; connect.viewschool[.]xyz; connect.voyagelaugh[.]xyz; connect.woolreward[.]xyz; connect.yearicicle[.]xyz; connect.zebratransport[.]xyz	CL-CRI-1171 installation-tracker infrastructure
Domain	controlprice[.]xyz; coughcoal[.]icu; countrypipe[.]space; cowsfoot[.]xyz; crackfood[.]space; creamfurniture[.]space; creditchickens[.]xyz; crediteducation[.]cfd; crimestreet[.]xyz; crimesupport[.]cfd; curvebite[.]xyz; deathrock[.]xyz; deathshop[.]xyz; decisionreaction[.]xyz; dinosaursjam[.]cfd; distancebedroom[.]xyz; distributiontheory[.]cfd; dolldebt[.]xyz; doorsoap[.]cfd; dustprotest[.]icu; expansionsalt[.]info; fallbeginner[.]xyz; fangbear[.]xyz	CL-CRI-1171 gate and landing infrastructure
Domain	filescenter[.]cloud; filesilo[.]cloud; fingerbasketball[.]xyz; flavorwood[.]xyz; fleshfrog[.]xyz; fleshplants[.]xyz; fleshproduce[.]xyz; foodrock[.]space; forkmice[.]xyz; friendjewel[.]cfd; geeseairport[.]xyz; girlsgrain[.]xyz; glassmove[.]xyz; goldsteel[.]cfd; governmentyard[.]cfd; grandfatherquiver[.]xyz; gripcollar[.]xyz; gripsleep[.]xyz; gunbear[.]xyz; hairreward[.]xyz; hatescale[.]info; healthiron[.]space; holemuscle[.]xyz; homecub[.]cfd; homefireman[.]xyz; honeyfear[.]xyz	CL-CRI-1171 gate and landing infrastructure
Domain	ilesilo[.]cloud; instrumentvolcano[.]space; kittenschalk[.]xyz; kittensgrade[.]cfd; kittensrobin[.]info; landerror[.]xyz; lesilo[.]cloud; liptendency[.]info; liquidtoes[.]xyz; liquidwrench[.]cfd; lockettrail[.]xyz; lumberbaseball[.]xyz; memorycompany[.]xyz; micesisters[.]xyz; milkname[.]xyz; minuteblade[.]xyz; mountainsurprise[.]cfd; mouthfruit[.]cfd; northbox[.]xyz; partpipe[.]xyz; partyfriends[.]cfd; passengerbrake[.]space; peacejewel[.]xyz; peacetongue[.]xyz; petminister[.]xyz; pictureporter[.]cfd	CL-CRI-1171 gate and landing infrastructure
Domain	pieplant[.]space; pizzasthread[.]xyz; pleasurewaves[.]info; popcornregret[.]xyz; porterdebt[.]xyz; powerbushes[.]xyz; profitfact[.]xyz; prosetoothbrush[.]xyz; quincepage[.]xyz; raintexture[.]xyz; rakepurpose[.]xyz; raterake[.]cfd; readingscience[.]xyz; reasonachiever[.]xyz; recessgiraffe[.]xyz; recordhistory[.]xyz; regretsquirrel[.]xyz; restbucket[.]xyz; ricestar[.]xyz; rifledog[.]xyz; ringsparcel[.]xyz; roadyear[.]xyz; rockcredit[.]space; rollglass[.]xyz; roofbattle[.]xyz; roofreaction[.]xyz	CL-CRI-1171 gate and landing infrastructure
Domain	rosegrip[.]xyz; routeletters[.]xyz; runhouses[.]xyz; scarecrowcare[.]xyz; scentrod[.]info; screwbirth[.]xyz; seatlace[.]space; seaword[.]xyz; servantadvice[.]xyz; shiptank[.]cfd; shirtexample[.]xyz; shoesearthquake[.]xyz; sinkwash[.]space; skirtloss[.]xyz; slipvegetable[.]xyz; smokecar[.]space; songtheory[.]xyz; spadeleg[.]xyz; sparkrice[.]space; sparkrub[.]xyz; spoonducks[.]cfd; springdogs[.]xyz; spybaseball[.]space; startmonkey[.]cfd; statementservant[.]xyz; steamhouses[.]cfd	CL-CRI-1171 gate and landing infrastructure
Domain	stopzinc[.]xyz; structurelinen[.]xyz; suggestioncemetery[.]xyz; suitsoap[.]xyz; swimrest[.]xyz; tablechess[.]info; tailsilk[.]xyz; territorycaption[.]xyz; texturebadge[.]xyz; thrillducks[.]xyz; throneback[.]xyz; tinsofa[.]xyz; toespiders[.]xyz; toothpastesense[.]xyz; toothpastesun[.]xyz; townquiver[.]xyz; trampdonkey[.]icu; treesboard[.]xyz; truckpig[.]cfd; truckshat[.]xyz; turnclass[.]xyz; umbrellavessel[.]xyz; vacationengine[.]xyz; vestthings[.]cfd; volcanopin[.]xyz	CL-CRI-1171 gate and landing infrastructure
Domain	wastereading[.]xyz; wasteturkey[.]xyz; wastewine[.]xyz; wavepan[.]xyz; whistlebook[.]cfd; whistlesong[.]xyz; wormspark[.]xyz; woundsecretary[.]xyz; wrenobservation[.]xyz; yamsmell[.]xyz; yardvalue[.]cfd; zephyrhall[.]cfd	CL-CRI-1171 gate and landing infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.