"We have identified more than 10,000 distinct loader samples," Unit 42 reported — a single sentence that reframes a routine infection as the front door to a vast, commercialized malware supply chain.
CL-CRI-1171, OfferLoader, and a pay‑per‑install marketplace
Unit 42 traces this activity to a cluster it calls CL-CRI-1171, an operation that has run for at least two years and functions as a pay‑per‑install (PPI) marketplace. The core delivery mechanism is OfferLoader, a trojanized Inno Setup installer that acts as a disposable, generic loader. OfferLoader’s design intentionally conceals downstream payloads: it spawns three separate child processes (eld0.exe, eld1.exe, eld2.exe), each corresponding to independent malware “offers,” and passes affiliate tracking data to each via the command line. Two separate intrusion sets examined by Unit 42 carried affiliate IDs CID=2855 and CID=3075.
YouTube channels and SEO‑poisoning: dual funnels into the same gate
CL-CRI-1171 funnels victims to its PPI gate through two parallel vectors. The first is SEO poisoning: search results for legitimate software lead to file‑hosting lure pages that display fake virus‑scan animations and then redirect through a chain to the loader. The gate embeds a click_id parameter — a Base64‑encoded fingerprint that contains the victim’s OS, browser, referring domain, the exact search keyword and public IP. The gate checks that fingerprint and serves malware only to “valid, fresh” clicks; scanners and crawlers see decoy pages, which helps explain the campaign’s limited public footprint despite high activity.
The second vector is a network of gaming optimization YouTube channels. Unit 42 identified 11 channels with hundreds of thousands of subscribers that published genuine‑looking content — FPS boosts, crash fixes and settings tweaks — and placed download links in descriptions that ultimately led through Blogspot intermediary pages into the same PPI gate. Unit 42 notified YouTube; the channels were terminated after that notification.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildThree distinct payload families seen in April 2026
Although OfferLoader is commodity in appearance, it delivered three very different malware families in operations observed in April 2026:
- Insomnia RAT (Operation A): a dual‑payload, cross‑platform backdoor composed of a Node.js agent (aa.js hosted on stryper[.]info) and a complementary Python agent (hosted on aa.amazingshield[.]xyz). The PowerShell installer t.ps1 disables Windows Defender, adds C:\ as an exclusion, suppresses security notifications, installs Node.js and Python, and registers scheduled tasks (Maps Performance Task and OOBETaskScheduler) for persistence. The Python agent used crowdstri[.]com — a deliberate typosquat — as its C2 domain.
- ARKTunnel (Operation B): a previously unreported WebSocket tunneling RAT. Eld1.exe uses least‑significant‑bit (LSB) steganography to extract a ZIP from a BMP image, producing wscl.exe (the tunneling RAT). ARKTunnel supports TCP and UDP tunneling, installs as a service (wscl-13 or msvcsrvc) and decodes its C2 reg.pcsdkflyer[.]ca from an encoded configuration blob. Unit 42 found at least 50 ARKTunnel samples spanning a year and rotating through fabricated corporate identities (e.g., EarthKark, TamarkLark).
- Docro Hijacker (Operation C): a Chrome backdoor that sideloads a Manifest V3 extension by bypassing Chrome’s Secure Preferences HMAC‑SHA256 integrity check. Eld2.tmp drops Adblock.dll, which extracts Chrome’s HMAC key from resources.pak and writes valid HMAC signatures to permit modification. The docro extension at C:\ProgramData\DocsHelper\docro contacts vendralo[.]info for per‑victim UUIDs and hourly rule updates, then injects monetization scripts from drelto[.]info/farlix and rewrites search results to mqsearch[.]com.
Rotational infrastructure, gating, and the camouflage of simplicity
Tracing OfferLoader’s infrastructure exposed over 200 rotational hostnames following a two‑word compound naming pattern (examples include bubbleslip, churchpail, dinosaursjam) and cycling through .xyz, .cfd, .space and .info TLDs. The loader’s gate logic — including click_id fingerprints and redirector chains — deliberately filters out automated analysis. Unit 42’s decoding of hundreds of click_id values was crucial to linking the SEO and YouTube funnels back to the same operation.
What this means for technologists, enterprises, and gamers
- Technologists and security teams: Treat commodity Inno Setup installers and other routine PUP‑style downloads as potential loaders. Look for gating indicators (rotational domains, click_id‑style tracking) and investigate seemingly minor post‑exploitation chains; OfferLoader’s entire purpose is to remain unremarkable while delivering diverse payloads.
- Enterprises and procurement leaders: The SEO path delivered trojanized utilities (examples: trojanized WinDirStat and a Bluetooth driver). Procurement and asset teams should verify software sources and monitor for installer‑spawned scheduled tasks (Maps Performance Task, OOBETaskScheduler) and unusual autostart services.
- End users and gamers: Channels promoted real, helpful gaming content yet linked to “optimization packs” that led to malware. Avoid downloading third‑party tools from video descriptions and follow supplier provenance for installers.
Unit 42’s work shows how scale can hide behind ordinary code: an untracked loader, modest in sophistication, can serve as the backbone for thousands of infections and multiple, unrelated malware families. For organizations and individuals alike, the record is blunt — the next compromise may look routine, but the payloads it conceals might not be. If you believe you may be compromised, Unit 42 recommends contacting its Incident Response team; Palo Alto Networks has also shared these findings with Cyber Threat Alliance members to accelerate protections.
