Gaming channels and SEO funnel powered a two-year malware campaign

September 21, 2026 1 min read

Infections reached corporate endpoints, including critical infrastructure and government entities, extending the campaign beyond gaming users.

Table of Contents

A cybercrime campaign operated for at least two years through gaming channels and an SEO funnel, with infections also reaching devices linked to corporate environments.

More than 10,000 samples of a malware loader were identified in a campaign that used fake gaming YouTube channels to distribute different malicious payloads.

The operation, tracked as CL-CRI-1171 by Palo Alto Networks’ Unit 42, involved at least 11 YouTube channels that amassed hundreds of thousands of followers and millions of views. Researchers determined that the group offered an infection service to other malicious actors through a pay-per-install model.

The group operated for at least two years and used content primarily aimed at gamers to promote downloads that could install malware. In parallel, it developed an SEO poisoning funnel targeting a more professional audience, with trojanized software that ultimately deployed malware on corporate endpoints, including critical infrastructure and government entities.

The campaign was identified through enterprise infections that initially appeared to be low priority. Upon investigating them further, researchers uncovered a larger-scale operation that used the same custom loader to distribute different payloads.

Related Posts:

Gaming channels distributed malicious software.

The identified channels published gaming content, including tips for improving frame rates, fixing bugs and adjusting settings. Although the videos provided genuine content for gamers, they also included download links that served as a distribution mechanism for malicious software.

The company notified YouTube about the 11 identified channels, and the platform proceeded to shut them down.

Between July 2025 and April 2026, Unit 42 identified three separate payloads delivered through the same loader: Docro Hijacker, ARKTunnel and a new variant of a previously unnamed backdoor, dubbed by researchers the Insomnia Remote Access Trojan (RAT). The first two had not been publicly reported.

More than 10,000 loader samples were identified.

In practice, the infections observed represent only part of a broader deployment campaign. The more than 10,000 distinct samples of the loader could deliver unique combinations of payloads.

The use of gaming channels and a parallel SEO funnel allowed the group to reach both gamers and users in professional environments while maintaining the same malware distribution mechanism.