CountLoader and GachiLoader Malware Spread Through Cracked Software and YouTube
- Securityish
- Threats & Incidents
Quick Summary
Cybersecurity researchers have identified a campaign using cracked software to distribute CountLoader and GachiLoader malware. CountLoader, detected since June 2025, is a modular loader that initiates a multi-stage attack, ultimately delivering the ACR Stealer information thief. Additionally, GachiLoader, distributed via compromised YouTube accounts, has been linked to over 220,000 views across 100 videos, highlighting the evolving threat landscape in malware distribution.
The Securityish Brief
Recent cybersecurity research has revealed a coordinated campaign leveraging cracked software and compromised YouTube accounts to distribute two types of malware: CountLoader and GachiLoader. CountLoader has been active since at least June 2025, functioning as a loader that facilitates a multi-stage attack process. This malware is capable of delivering various payloads, including the ACR Stealer, which targets sensitive data from infected systems.
The attack begins when users attempt to download cracked versions of legitimate software, such as Microsoft Word, leading them to a malicious ZIP file hosted on MediaFire. This ZIP file contains a disguised Python interpreter that executes commands to retrieve CountLoader from a remote server. The malware establishes persistence by creating a scheduled task that mimics Google services, allowing it to run every 30 minutes for an extended period.
GachiLoader, on the other hand, is a JavaScript malware loader distributed through a network of compromised YouTube accounts, with around 100 videos flagged for malware distribution. This loader has been linked to the deployment of the Kidkadi malware, which utilizes advanced techniques for Portable Executable (PE) injection. The campaign underscores the sophistication of current malware distribution methods and the importance of vigilance among users.
Both CountLoader and GachiLoader demonstrate evolving tactics that exploit user behavior and software vulnerabilities. The use of legitimate software names and platforms, such as Google and YouTube, increases the likelihood of user trust, making these attacks particularly dangerous. Users should be aware of the risks associated with downloading cracked software and the potential for malware hidden in seemingly harmless files.
As these malware types continue to evolve, they highlight the need for proactive security measures, including regular monitoring of installed software and heightened awareness of suspicious downloads. Organizations and individuals alike must remain vigilant against these threats to protect sensitive data and maintain system integrity.
Key Takeaways
- Avoid downloading cracked software, as it often contains hidden malware like CountLoader.
- Regularly monitor your system for unusual scheduled tasks that may indicate malware persistence.
- Ensure your security software is up to date and actively scanning for threats.
- Be cautious of links in emails or messages that lead to software downloads, especially from unverified sources.
- Educate yourself and your team about the risks of malware distributed through platforms like YouTube.
Key Terms & Concepts
- CountLoader: In this article, CountLoader refers to a modular malware loader used to facilitate multi-stage attacks and deliver additional malicious payloads.
- GachiLoader: GachiLoader is a JavaScript malware loader that distributes additional malware through compromised YouTube accounts.
- ACR Stealer: ACR Stealer is an information-stealing malware that targets sensitive data from infected hosts.
- PE injection: PE injection is a technique used by malware to insert malicious code into legitimate processes.
- removable USB drives: Removable USB drives are portable storage devices that can be exploited by malware to spread across systems.
Read the original article here: https://thehackernews.com/2025/12/cracked-software-and-youtube-videos.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
