The threat actors aren’t slowing down, Digital Defenders.

YouTube malware traps, ChatGPT token leaks, and cloud gift card heists. Even gamers aren’t spared… Python spyware turns playtime into compromise.

Here’s what you need to know:

Zero-Day Download

Ghost Network Turns YouTube Into Malware Trap

Check Point researchers uncovered the YouTube Ghost Network — over 3,000 fake gaming videos spreading info-stealing malware. 

Active since 2021 and surging in 2025, the campaign uses hijacked accounts with fake likes and comments to lure users to malware-packed archives on Dropbox and Google Drive. Payloads like Rhadamanthys and HijackLoader steal credentials while rotating servers to evade detection.

Source: Giphy

This is an ongoing campaign in the wild.

Organizations should block YouTube downloads on managed devices, enforce least-privilege browsing, monitor DNS traffic for rapid C2 rotation, and educate users on the dangers of pirated software.

OpenAI’s Atlas Browser Leaks User Access Keys

A flaw in OpenAI’s ChatGPT Atlas browser exposes unencrypted OAuth tokens on macOS, risking unauthorized account access.

Researchers found ChatGPT Atlas stored OAuth tokens in a readable SQLite file with 644 permissions, bypassing macOS Keychain encryption. 

The flaw exposes user data and highlights the risks of AI browsers that blend automation, privacy features, and sensitive personal information. OpenAI has not released an official response to this discovery.

Until a fix is confirmed, block Atlas deployments, enforce 2FA for OpenAI accounts, and monitor for unusual API access patterns.

Turning Compliance Chaos into Profit for MSPs

With CMMC enforcement in full swing, many MSPs are racing to navigate an increasingly complex compliance landscape.

Alex Spiegel, COO of Choice Cyber Solutions, sees CMMC as a major opportunity. With stricter rules for federal contractors, MSPs that embrace compliance can turn it into a revenue driver and a foundation for efficiency, trust, and lasting client relationships. 

Start documenting compliance processes today. Clear, concise policies — no more than two pages — can both satisfy auditors and demonstrate your MSP’s value to clients.

Share this newsletter!

Pulse Check

Would you spot a malware trap hidden in a “free” YouTube download? 

Yesterday's Pulse Check Results

AWS Wellness Check: Were you caught in last week’s AWS outage?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Jingle Thief Loots Cloud Accounts for Gift Card Cash

Unit 42 researchers uncovered Jingle Thief, a Morocco-based cloud campaign stealing credentials via phishing and smishing to infiltrate Microsoft 365 and commit large-scale gift card fraud.

Tracked as CL-CRI-1032, the group persists for months by abusing Microsoft Entra ID and Exchange — adding inbox rules, rogue devices, and fake approvals for gift card fraud.

Source: Giphy

The campaign reflects a shift toward cloud identity abuse, hitting retail and enterprise sectors hardest during holiday peaks. This is an ongoing attack.

Enforce conditional access, audit device enrollments, monitor inbox rules, require phishing-resistant MFA, and use behavioral analytics to spot identity abuse early.

Fake Minecraft Client Hides Python Spyware

Netskope discovered a Python-based RAT disguised as the “Nursultan Client” Minecraft tool, using Telegram’s Bot API for command and control.

The malware masquerades as gaming software to steal data, Discord tokens, and webcam images, using Telegram for stealthy C2 operations that evade detection. 

Despite its amateur origins, its modular, API-driven design makes it a plug-and-play tool for cybercriminals exploiting gaming communities for credential theft and surveillance. This is an ongoing campaign.

Users should stick to verified mod sources, disable Discord token storage, and have security teams monitor outbound Telegram API traffic.

Why Elastio and AWS are Your Best Defense Against Hidden Ransomware

Malware scanners alone can’t keep up. Today’s ransomware hides in backups, evades signatures, and turns your safety net into a liability. That’s why Elastio partnered with AWS to deliver Ransomware Recovery Assurance. AWS provides unmatched scale and secure storage—but even the strongest vaults are at risk when backups are infected. Elastio adds behavior-based detection, continuous validation, and provable recovery on top of AWS snapshots and backups, ensuring you always have a clean point to restore from.

With Elastio and AWS:

• Backups are actively monitored for ransomware that scanners miss.

• Every snapshot is validated, so corruption is caught before recovery.

• Clean, audit-ready recovery paths are guaranteed for compliance and speed.

Don’t just assume your data is safe—prove it. Together, Elastio and AWS ensure confidence that their data is both secure and resilient.

Security Tip of the Day

Could a Cheat Code Cost You Your Data?

Cybercriminals now target gamers with fake mods, cheats, and phishing lures that steal credentials or install malware. One breach can expose payment info, personal data, and even work accounts.

Practicing strong gaming security habits has never been more critical.

Source: Giphy

How to protect your gaming accounts:

Smart gaming habits protect your fun and digital identity. Stay alert, verify downloads, and layer defenses to play safely. 

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.