Researchers Identify Over 10,000 Malware Loaders Powering YouTube-Based Pay‑Per‑Install Scheme

Security researchers have traced a massive pay‑per‑install network that has deployed more than 10,000 variants of a custom malware loader known as OfferLoader. The operation, catalogued as cluster CL‑CRI‑1171, leveraged popular YouTube gaming channels and search‑engine‑optimized (SEO) software downloads to deliver malicious code to unsuspecting users on a large scale.

The scheme relied on the credibility of gaming influencers, embedding malicious links in video descriptions and comments that appeared to point to legitimate game mods or utilities. Simultaneously, the attackers optimized compromised web pages so that they ranked highly for common software‑related queries, a technique known as SEO poisoning. When users clicked the promoted links, they were redirected to the OfferLoader payload, which silently installed additional trojans or ransomware.

OfferLoader itself is a modular loader designed to fetch and execute a range of secondary payloads. Researchers identified more than 10,000 distinct samples, each slightly altered to evade signature‑based detection. The CL‑CRI‑1171 cluster groups these variants together, indicating coordinated development and distribution. Although the exact actors remain unidentified, the consistent code base and shared infrastructure suggest a single organized group behind the campaign.

The scale of the operation underscores the growing sophistication of PPI services, where cybercriminals monetize each successful installation by sharing revenue with affiliates. By exploiting trusted platforms such as YouTube, the attackers broadened their reach beyond traditional malicious sites, catching users who might otherwise trust a familiar content creator. The sheer number of loaders points to a sustained effort that likely persisted for months, if not years, before detection.

Pay‑per‑install models have become a lucrative vector for distributing ransomware, adware, and credential‑stealing tools, especially when combined with SEO manipulation. Security analysts note that the blend of social‑media influence and search‑engine tactics makes remediation difficult, as takedown requests must address both video platforms and a dispersed network of compromised domains. The discovery highlights the need for tighter verification of links shared by content creators and more aggressive monitoring of SEO‑poisoned pages.

Researchers say ongoing monitoring of the CL‑CRI‑1171 cluster will focus on identifying new loader variants and mapping affiliate relationships. Users are advised to verify download sources, avoid clicking links in unsolicited video descriptions, and keep security software up to date. The findings, initially reported by GBHackers, add to a growing body of evidence that PPI operations can infiltrate mainstream online ecosystems, prompting calls for coordinated industry response.