Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 discovered a long-running pay-per-install (PPI) malware campaign tracked as CL-CRI-1171, which has operated under the radar for at least two years by distributing multiple payloads through a shared loader infrastructure. The campaign uses YouTube channels and SEO poisoning to distribute trojanized software, targeting both gamers and corporate users. The loader, dubbed OfferLoader, delivers various malware families including the previously undocumented Docro Hijacker and ARKTunnel, as well as a new variant of the Insomnia RAT. These payloads enable backdoor access, browser hijacking, and WebSocket tunneling, with infrastructure designed to evade detection through domain rotation and gating mechanisms that filter out scanners.

AI-extracted · verify before operational use