Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

A recent investigation by Palo Alto Unit 42 has uncovered a significant cybercrime campaign, designated as CL-CRI-1171, targeting young gamers and corporate entities. The group operates a Pay-Per-Install (PPI) marketplace, distributing malware through a layered infrastructure including YouTube channels and SEO poisoning. The operation has been active since at least 2025, and has been linked to over 10,000 unique loader samples.

At the core of this campaign is a shared loader, dubbed OfferLoader, which is a trojanized Inno Setup installer. This loader is designed to be disposable and generic, making it difficult to detect and analyze. It’s used to deliver a variety of payloads, including three distinct malware families: Insomnia RAT, ARKTunnel, and Docro Hijacker.

The campaign utilizes two primary delivery channels. First, YouTube channels, numbering over 11, generated significant views and downloads by providing gaming optimization tips that subtly included links to malicious “tool” or “optimization pack” downloads. These links passed through intermediary sites, such as Blogspot, which contained social-engineering instructions to guide users to the same PPI gate infrastructure. Second, the group employs SEO poisoning, directing users searching for legitimate software to malicious domains.

To achieve this, the group uses a sophisticated gating mechanism. When a user searches for a legitimate utility, they are directed to a malicious domain. The domain then presents a fake virus-scan animation before delivering the trojanized archive via a chain of redirectors into the PPI gate. The gate uses a click_id parameter – a Base64-encoded fingerprint containing the victim's operating system, browser, referring domain, search keyword, and public IP address – to determine who receives the payload. This ensures that only real targets are infected and protects the actor’s infrastructure from scanners and crawlers.

Between June 2025 and April 2026, the investigation identified three malware strains delivered by CL-CRI-1171:

• **OfferLoader:** The delivery mechanism behind all recorded intrusions, a trojanized Inno Setup installer that sets up the other payloads.
• **Operation A: Insomnia RAT:** A dual-payload, cross-platform backdoor that brings its own environment to ensure survival, targeting both Windows and macOS using Node.js and a twin Python agent.
• **Operation B: ARKTunnel:** A previously unreported WebSocket tunneling RAT unpacks itself from a bitmap image using steganography. The campaign has been active for over a year, with 50 samples.
• **Operation C: Docro Hijacker:** A Chrome backdoor that re-engineers a browser-hijacking technique first seen in 2015, bypassing modern integrity protections.

In two separate intrusion sets, the investigation found that the ZIP file contained OfferLoader masquerading as a windirstat.exe installer that initiates the compromise by unpacking windirstat.tmp. This temporary file transmits an initial tracking beacon to voyagemist[.]space. Based on the structure of the beacon, one of two text files will be retrieved. They either contain “no” to signal that the loader should not unpack further stages, or “ok” to signal all offers will be deployed. Following this check-in, the process spawns three child processes: eld0.exe, eld1.exe and eld2.exe. Each child process corresponds to a different malware campaign. The loader passes specific affiliate-tracking parameters to each process via a command line.

Unit 42 recommends that Palo Alto Networks customers are better protected through their existing security measures. The investigation highlights the importance of vigilance and proactive threat hunting, particularly when encountering seemingly legitimate content promoting software downloads.