Be very quiet: YouTube is hunting malware

Digital scams get more sophisticated with each passing year, but YouTube is fighting back. Google’s video platform teamed up with cybersecurity company Check Point to bust a malware operation known as the YouTube Ghost Network.

By uploading deceptive videos, the Ghost Network convinced its marks to install info-stealing software like Rhadamanthys and Lumma. The installers were hidden behind seemingly innocuous videos that promised hacks for Roblox games and workarounds for paywalled programs like Microsoft Office and Adobe Photoshop.

The Hacker News noted that the YouTube Ghost Network had been operational since 2021 and had uploaded more than 3,000 fraudulent videos, some of which collected more than 290,000 views. As Check Point researchers explained, those significant traffic numbers are part of the malware scheme. By using multiple accounts devoted to specific tasks — such as posting the trap videos or engaging with them — the YouTube Ghost Network made its content seem legitimate.

A statement from Check Point commented on “the remarkable adaptability and resourcefulness of threat actors,” who are finding new ways to circumvent platform-level security measures. “This operation took advantage of trust signals, including views, likes, and comments, to make malicious content seem safe,” said Eli Smadja

of Check Point. “What looks like a helpful tutorial can actually be a polished cyber trap. The scale, modularity, and sophistication of this network make it a blueprint for how threat actors now weaponize engagement tools to spread malware.”

Malware has long been a thorn in YouTube’s side, and recent developments have only made bad actors harder to uncover. Generative AI aids scammers while also eroding trust in on-platform content — a problem that makes the Ghost Network’s “trustworthy” library harder to avoid.

YouTube certainly isn’t the only platform grappling with this technological conundrum. Viewbotters on streaming hubs like Twitch and Kick are also adopting more advanced technology, requiring security teams to work harder to keep users out of trouble. Individual viewers can protect themselves by watching out when a Roblox tutorial seems too good to be true. And despite what YouTube might want, you should take its viewership numbers with a grain of salt.