Threat Intel
CL-CRI-1171 PPI Marketplace Distributes Malware via YouTube Gaming Channels and SEO Funnel
A threat actor known as CL‑CRI‑1171 has operated a pay‑per‑install marketplace for two years, leveraging YouTube gaming channels and a search‑engine‑optimization funnel to deliver malware. The operation uses a custom loader, OfferLoader, to drop payloads such as Docro Hijacker, ARKTunnel, and the Insomnia RAT on corporate and critical infrastructure endpoints. Defenders should block malicious links, monitor for OfferLoader signatures, and ensure recent patches for known vulnerabilities are applied.
What Happened
CL‑CRI‑1171 runs a pay‑per‑install (PPI) marketplace that distributes malware through YouTube gaming channels and a parallel SEO‑poisoning funnel. The channels actively engage viewers, luring them to download malicious tools, while the SEO funnel targets professionals with trojanized software.
Palo Alto Networks Unit 42: "These channels were actively interacting with viewers to promote gaming content laced with links to download malware."
Impact
Corporate endpoints, critical infrastructure, and government systems have been infected with a custom loader called OfferLoader, which has delivered three payloads between July 2025 and April 2026: Docro Hijacker (a Chrome backdoor), ARKTunnel (a WebSocket tunneling RAT), and the cross‑platform Insomnia RAT. Post‑April 2026, the infrastructure has spawned GCleaner and Socks5Systemz.
What to Do
- Block or filter URLs and domains associated with the PPI marketplace and known malicious YouTube channels.
- Deploy endpoint detection that flags OfferLoader binaries and the three documented payloads.
- Ensure all systems are patched for the 800+ flaws that were recently remediated, reducing the attack surface for similar exploitation.
- Educate users about the risk of downloading software from gaming channels and untrusted search results.
- Monitor for signs of LocalAI or other exposed AI services that attackers may target.
Related articles
US Treasury Sanctions Tren de Aragua Members Over ATM Jackpotting Attacks
The U.S. Treasury Department has sanctioned eight members of the Venezuelan Tren de Aragua gang for orchestrating ATM jackpotting attacks that stole millions from U.S. banks. The sanctions target individuals who deployed malware such as Ploutus to force ATMs to dispense cash and erase evidence. Defenders should update ATM firmware, monitor for known malware, and enforce network segmentation.
Read briefing
ClickFix Attacks: User-Executed Malicious Commands
ClickFix attacks rely on deceiving users into executing malicious commands, often via copy-pasted instructions. Defenders should focus on user awareness training and implement browser/endpoint security controls to prevent command execution. CrowdStrike Falcon offers layered protection against this technique.
Read briefing
NeedyMantis: Modular Post‑Compromise Malware Used in Targeted Attacks
Microsoft Threat Intelligence has identified NeedyMantis, a modular post‑compromise malware framework used to maintain long‑term access in targeted intrusions against telecoms, universities, medical nonprofits, intergovernmental organizations and government contractors. The malware, first seen in October 2025, combines custom loaders, encrypted archives and extensible components to evade analysis and support follow‑on operations. Defenders should monitor for its indicators, block its C2 domains, and apply Microsoft Defender detections.
Read briefing
PhantomRaven: JavaScript Info Stealer Developed by Bug‑Bounty Threat Actor
CrowdStrike uncovered PhantomRaven, a JavaScript‑based information stealer created by a financially motivated threat actor who operates as a bug‑bounty hunter. The malware targets web applications, harvesting credentials and sensitive data via injected scripts. Defenders should inspect client‑side code, enforce strict CSP, and monitor for anomalous JavaScript activity.
Read briefing