YouTube Game Cheats: The New Bait for Arcane Stealer Malware

Cybercriminals are constantly evolving their tactics, and their latest trick involves exploiting YouTube videos that promise game cheats to unsuspecting users. The recently discovered Arcane Stealer malware is being spread via these videos, targeting primarily Russian-speaking users.

How the Attack Works

The attack begins when a user clicks on a link in the video description, leading to a password-protected archive. Once opened, the archive runs a batch file ( start.bat) that triggers a series of malicious commands via PowerShell. These commands:

  • Retrieve and unpack another archive file
  • Launch two executable files—one being a cryptocurrency miner and the other the Arcane Stealer malware
  • Disable Windows SmartScreen protection to evade detection

This combination of tactics allows cybercriminals to operate stealthily, deploying multiple payloads at once while bypassing security measures.

What Arcane Stealer Targets

Arcane Stealer is a highly capable information thief, with an extensive list of targets, including:

  • VPN Clients – OpenVPN, NordVPN, ExpressVPN, and more
  • Network Utilities – FileZilla, ngrok, Playit, Cyberduck, etc.
  • Messaging Apps – Telegram, Discord, Signal, Skype, and others
  • Email Clients – Microsoft Outlook
  • Gaming Platforms – Steam, Riot Client, Ubisoft Connect, Battle.net, and even Minecraft launchers
  • Cryptocurrency Wallets – Ethereum, Electrum, Atomic, Jaxx, and more

On top of that, Arcane Stealer can take screenshots, record system data, and extract Wi-Fi credentials—making it a dangerous threat for both individuals and organizations.

The Evolution of Arcane Stealer

Arcane Stealer is believed to be a variant of the Phemedrone Stealer malware, with new capabilities added over time. It employs advanced techniques such as:

  • Cracking browser encryption keys using the Xaitax utility
  • Extracting sensitive cookies from Chromium-based browsers via debug ports
  • Bypassing traditional security measures to maintain persistence

Additionally, cybercriminals have now bundled this stealer with ArcanaLoader, a loader that masquerades as game cheats but delivers Arcane instead. This highlights how attackers continually refine their tools to stay ahead of security defences.

Why This Matters

This attack campaign highlights how cybercriminals capitalize on popular online trends, like game cheats, to distribute malware. It is a clear reminder that:

  • No cheat or hack is worth compromising your security.
  • Never download files from unverified sources, even if they appear on trusted platforms like YouTube.
  • Organisations should educate users about social engineering threats that can lead to credential theft and malware infections.

At Custodian360, we continuously monitor evolving cyber threats and help businesses strengthen their security posture. If your organisation wants to protect against these types of threats, talk to us about how we can help detect and mitigate malware before it causes damage.

Stay secure, stay informed, and never trade security for convenience.