Comprehensive Threat Exposure Management Platform
Hive Pro recognized in Gartner® Magic Quadrant™ for Exposure Assessment Platform, 2025 Watch platform in action
GachiLoader is a Node.js-based malware loader used to deliver the Rhadamanthys infostealer through a large-scale campaign that abuses compromised YouTube accounts in what researchers call the YouTube Ghost Network. The GachiLoader malware campaign highlights a growing trend toward unconventional malware development using Node.js and refined distribution methods, underscoring the increasing abuse of trusted platforms like YouTube for scalable malware delivery. First observed in 2021, the YouTube Ghost Network became active and expanded to 39 compromised YouTube accounts by December 2024, publishing over 100 malicious videos promoting fake game cheats and pirated software that collectively reached approximately 220,000 views. Between March and May 2025, the YouTube Ghost Network distributed Lumma infostealer through approximately 3,000 malicious videos before threat actors updated their infrastructure on September 23, 2025, replacing the original payload with GachiLoader malware. The GachiLoader campaign exploits user trust in YouTube platform visibility by luring victims through video descriptions containing links to password-protected archives hosted on file-sharing services, often accompanied by instructions to disable Windows Defender before execution. Once launched, GachiLoader malware profiles the host system, collecting operating system information and installed security products, then transmits reconnaissance data via POST requests to command-and-control infrastructure to evade sandbox environments and security analysis. GachiLoader delivers the Rhadamanthys infostealer payload either directly from command-and-control servers or through an embedded secondary component known as Kidkadi dropper. The GachiLoader malware reflects a broader shift toward unconventional technologies in malware development, with threat actors leveraging Node.js to complicate detection while employing a novel executable injection technique called “Vectored Overloading” that hides malicious executables inside legitimate DLLs and abuses Windows exception handling mechanisms.
GachiLoader is a newly identified, heavily obfuscated loader written in Node.js and designed to deploy multiple malicious payloads on compromised Windows systems. The primary role of GachiLoader in the observed campaign is the delivery of the Rhadamanthys infostealer. The GachiLoader malware is distributed through the YouTube Ghost Network, a large-scale malware delivery operation that hijacks legitimate YouTube accounts to reach victims at scale.
These compromised YouTube channels in the Ghost Network promote fake game cheats and pirated software, exploiting user trust and YouTube platform visibility. Victims of the GachiLoader campaign are lured through video descriptions containing links to password-protected archives hosted on common file-sharing services, often accompanied by instructions to disable Windows Defender before execution. This social engineering tactic reduces the likelihood of detection during the GachiLoader malware installation process.
Once launched, GachiLoader begins by profiling the host system. The malware collects information such as the operating system version and installed security products, then transmits this reconnaissance data via POST requests to the command-and-control infrastructure. This GachiLoader reconnaissance phase helps the malware evade sandbox environments and security analysis by identifying virtual machines and security tools before deploying subsequent payloads.
Rhadamanthys infostealer payload delivery varies by GachiLoader campaign. In one case, GachiLoader retrieves the next-stage payload directly from its command-and-control server through encrypted communications. In another variant, the Rhadamanthys payload is embedded within the GachiLoader itself and executed through a secondary component known as Kidkadi, which is dropped during runtime to maintain operational security and evade detection.
GachiLoader reflects a broader shift in malware development toward unconventional technologies. By leveraging Node.js for malware creation, threat actors complicate detection while expanding operational flexibility since Node.js is less commonly monitored than traditional malware development languages. Combined with the abuse of trusted platforms like YouTube through the Ghost Network and a novel executable injection technique referred to as “Vectored Overloading,” which hides a malicious executable inside a legitimate DLL and abuses Windows exception handling to quietly trigger execution, this GachiLoader campaign demonstrates a refined and deliberate approach to modern malware distribution that bypasses traditional security controls.
Endpoint Hardening and Execution Control: Reduce exposure by limiting script and runtime abuse on Windows systems. Node.js should not be present or executable on endpoints unless there is a clear business requirement for the JavaScript runtime environment. Enforce application allowlisting to prevent unauthorized loaders like GachiLoader and secondary executables from running, particularly those launched from user-writable directories such as Downloads or Temp folders where GachiLoader malware typically executes.
Detection and Behavioral Monitoring: Implement behavioral detection for abnormal process activity, including Node.js instances performing system reconnaissance or initiating outbound network connections characteristic of GachiLoader malware. Monitor for suspicious artifacts such as randomly named .lock files in temporary directories, which may indicate execution control mechanisms used by loaders like GachiLoader to maintain persistence and coordinate malware deployment.
Network Visibility and Command and Control Detection: Inspect outbound traffic for unexpected POST requests to unfamiliar infrastructure originating from non-browser processes, which is characteristic of GachiLoader command-and-control communications. Early-stage beaconing used for host profiling and payload retrieval in the GachiLoader infection chain can often be detected through network monitoring and anomaly-based alerts before the Rhadamanthys infostealer is deployed.
Initial Access:
Execution:
Persistence:
Privilege Escalation:
Defense Evasion:
Discovery:
Collection:
Command and Control:
Exfiltration:
Get through updates and upcoming events, and more directly in your inbox