Security researchers have uncovered GachiLoader, a highly obfuscated malware loader written in Node.js that incorporates advanced evasion capabilities and unconventional code-injection techniques. The malware is propagated via the so-called “YouTube Ghost Network,” a coordinated distribution operation that abuses compromised YouTube accounts to promote malicious installers disguised as legitimate software, including cracked applications, game cheats, and productivity utilities.
Technical Execution and Evasion Techniques
GachiLoader employs a multi-stage infection chain specifically engineered to bypass modern endpoint detection and response (EDR) solutions. In one observed execution path, the loader deploys a secondary payload, Kidkadi, which introduces a novel variation of Portable Executable (PE) injection.
This method begins by loading a benign, digitally signed DLL—often a legitimate Windows system component—to establish an initial trust context. GachiLoader then abuses the Windows Vectored Exception Handling (VEH) framework by registering a malicious exception handler. Through this handler, the malware intercepts execution flow and dynamically overwrites the DLL’s in-memory code sections with attacker-controlled instructions. The result is a process-hollowing–like technique that enables arbitrary code execution while preserving the outward appearance of a trusted binary, significantly hindering memory forensics and static detection.
Before executing any payload, GachiLoader conducts extensive anti-analysis and privilege validation checks. It invokes the net session command to determine whether it is running with administrative privileges. If the command returns an access-denied error, the loader attempts to relaunch itself with elevated permissions, triggering a User Account Control (UAC) prompt.
Once administrative access is obtained, the malware actively degrades built-in defenses. It forcibly terminates SecHealthUI.exe, the Microsoft Defender user interface process, reducing user visibility into real-time protection status. In parallel, it programmatically configures Windows Defender exclusion paths for critical directories—C:\Users\, C:\ProgramData\, and C:\Windows\—effectively preventing antivirus scanning of subsequently deployed components and enabling stealthy persistence.
Payload Delivery and Execution Model
The final-stage payload is delivered through one of two channels: a direct HTTPS download from attacker-controlled command-and-control (C2) infrastructure, or local execution via the Kidkadi module (kidkadi.node), a native Node.js addon. In the latter case, the payload is executed entirely in memory using the VEH-based code-replacement technique, leaving little to no disk footprint.
Observed payloads include Rhadamanthys, a mature information-stealing malware capable of exfiltrating credentials, authentication tokens, cryptocurrency wallet data, and browser artifacts. The flexibility in payload selection indicates that GachiLoader operates as a malware-as-a-service (MaaS) framework, enabling operators to tailor deployments to specific objectives.
Campaign Scale and Distribution Infrastructure
The campaign leveraged approximately 100 malicious YouTube videos published across 39 compromised channels between December 22, 2024, and the public disclosure date. Collectively, these videos accumulated an estimated 220,000 views before removal. Video descriptions embedded links to file-sharing services or URL shorteners that redirected users to attacker-controlled hosting infrastructure distributing the trojanized installers.
By abusing established, compromised accounts rather than newly created ones, the operators benefited from pre-existing subscriber bases and reputational trust, reducing the likelihood of immediate platform enforcement. Most of the identified content has since been removed following coordinated reporting.
Threat Assessment and Defensive Implications
The operators behind GachiLoader demoes a high level of expertise in Windows internals, particularly in exception handling abuse and EDR evasion. The practical, large-scale deployment of VEH-based in-memory injection—a technique historically discussed but rarely observed in active campaigns—suggests ongoing research and operational maturity.
This activity highlights the continued evolution of adversary tradecraft toward fileless execution, living-off-the-land techniques, and anti-forensic measures designed to undermine signature-based defenses. Effective mitigation requires a shift toward behavioral and memory-based detection, including monitoring for anomalous VEH handler registrations, in-memory code replacement, and tampering with Microsoft Defender components. Organizations should enforce strict privilege controls, apply application whitelisting, and deploy advanced endpoint protection solutions capable of detecting in-memory injection and defense-evasion behaviors.