Long-Running Pay-Per-Install Operation Discovered
A substantial pay-per-install (PPI) operation has been revealed, which leverages popular YouTube gaming channels and SEO-poisoned software downloads to distribute malware on a large scale. This operation, known by its tracking label CL-CRI-1171, is linked to a staggering 10,000 distinct samples of a custom loader dubbed OfferLoader. This remarkable statistic suggests a distribution pipeline far more extensive than the isolated intrusions initially observed by cybersecurity experts.
Instead of deploying a singular, advanced malicious implant or an overtly targeted intrusion chain, the operators of this malware network utilized a more sophisticated methodology. They employed trojanized installers, created disposable domains, and implemented browser-based filtering along with affiliate tracking to selectively deliver malicious payloads. This multifaceted approach not only enhances their operational efficiency but also helps them evade automated analysis systems designed to detect such threats.
According to researchers from Unit 42, the PPI operation has been active for at least two years and functions similarly to an "infection-as-a-service" platform. In such a model, access to compromised systems can be sold to various downstream actors, allowing one seemingly benign installer to deploy unrelated malware families, each possessing its own command-and-control infrastructure and monetization models.
Unit 42 identified at least eleven YouTube channels implicated in this operation. Collectively, these channels boasted hundreds of thousands of subscribers and millions of views, providing content that appears legitimate while focusing on gaming performance improvements, crash fixes, and optimizations. However, the descriptions accompanying the videos and their linked pages typically directed unsuspecting users to malicious "optimization tools," cheats, utilities, or software packages.
These links would frequently redirect through intermediary Blogspot pages before reaching the PPI gate infrastructure utilized by the campaign’s SEO-poisoning activities. Following a notification from Unit 42, YouTube took action to terminate these channels, mitigating the operation’s reach on the platform.
In a parallel tactic, the operation executed an SEO-poisoning funnel targeting users searching for authentic tools and software. Investigators have noted that victims compromised their systems by downloading trojanized versions of tools like a Bluetooth driver and the disk-usage utility WinDirStat. Fake download pages utilized misleading virus-scan animations and lured users with appealing file-hosting options before delivering ZIP archives packed with malevolent installers.
The attack chain contained a sophisticated gating mechanism to filter user traffic effectively. Tracker URLs incorporated a Base64-encoded click_id parameter, gathering important telemetry data including the visitor’s operating system, browser type, referring domain, search term, and public IP address. Only genuine victim fingerprints were passed through to the malware download, while crawlers, security scanners, and cybersecurity researchers received broken links or decoy pages that impersonated legitimate WinRAR downloads.
The core delivery component, OfferLoader, is embedded within trojanized Inno Setup installers. Rather than maintaining long-term access, it serves as a disposable deployment framework that initiates separate malware "offers" supplied by various PPI customers. In one example, a seemingly innocuous windirstat.exe installer unpacked a temporary module that connected to a tracking server. The server interacted with this component, returning either a "no," stopping the execution, or an "ok," which initiated multiple child processes for malware delivery.
Unit 42 traced over 200 rotating infrastructure domains that relied on a distinctive two-word naming convention across a variety of top-level domains, including .xyz, .cfd, .space, and .info. This rotational infrastructure, coupled with a shared loader and overlapping delivery methods, has effectively tied the YouTube channels and SEO campaigns to a single, continued malware cluster.
In April 2026, incidents tied to this operation were found to deliver three different malware families: Insomnia RAT, ARKTunnel, and Docro Hijacker. A later infection in June, however, introduced new payloads—GCleaner and Socks5Systemz—which highlighted the modular capabilities of OfferLoader’s payload set and its ability to adapt based on affiliate needs or the requirements of various campaigns.
Insomnia RAT is characterized by its use of both Node.js and Python backdoors, providing multiple redundant access paths. It has been found to disable Microsoft Defender protections, creating scheduled tasks that masquerade as standard Windows components and using the user-agent string insomnia/2023.4.0 Windows for communication with command servers.
ARKTunnel, another noteworthy component, functions as a WebSocket-based tunneling RAT capable of extracting payload archives from bitmap images utilizing least-significant-bit steganography. It supports both TCP and UDP tunneling and file execution.
Finally, Docro Hijacker is specifically designed to modify Google Chrome’s Secure Preferences by bypassing the browser’s HMAC-SHA256 integrity check. This enables it to enforce search-provider changes, install unauthorized extensions, inject advertising, and redirect search traffic to attacker-controlled infrastructure.
The implications of this campaign highlight the significant risks associated with perceived “low-priority” detections involving adware-like loaders, dubious installers, and potentially unwanted software. Hence, security teams are urged to investigate unsigned installers from search results, monitor recently registered domains, and scrutinize any browser preference changes or unexpected Chrome extensions.
Organizations are also advised to prohibit the download of pirated software, game cheats, and unofficial optimization tools, particularly when sourced from links promoted through video descriptions or search engine results. Notably, the strength of this malware operation lies not in a single exploit but in its scalable and selective distribution system designed to render compromises appear ordinary.