The Video Is the Bait: How YouTube Scam Lures Work, and How I'm Cutting Them Off
You search YouTube for a Roblox script, a free copy of Photoshop, or an "AI trading bot" that promises easy crypto profits. You find a slick video with thousands of views, a confident voice-over, and a comment section full of people saying "works perfectly, thanks!" The download link is right there in the description.
That link is the scam. The video is just the bait.
I've spent the last several weeks watching these videos at scale, and I want to walk you through what they are, where they came from, what to watch for, and two big takedowns from this week that cut off nearly 800 of them at once.
What Is a YouTube Lure?
A YouTube lure is a video whose real purpose is to get you to click a link and download or paste something. The video itself usually breaks no obvious rule. It shows someone "using" a cheat or a cracked program, and it tells you exactly where to get it.
The ones I see most often fall into a handful of types:
Game cheats and "executors." Aimbots, wallhacks, unlock-all skin changers, and Roblox script runners for Fortnite, Valorant, Counter-Strike 2, Roblox, and many others. This is by far the biggest group, and its audience skews young.
Cracked software. "Free" Photoshop, Office, video editors, and paid games.
Free currency generators. "Unlimited Robux" or "free V-Bucks" pages that ask you to sign in, and then keep your password.
Crypto trading bots. A tutorial walks you through pasting "bot" code into a website that looks like a real developer tool, then depositing crypto so the bot can "trade." The deposit goes straight to the scammer.
Modded apps. "Premium unlocked" versions of popular phone apps that come with something extra.
The download behind a cheat or cracked-software video is almost always an information stealer: a small program that quietly grabs your saved passwords, browser sessions, crypto wallets, and Discord and game accounts, then sends them to the criminal. Most of them work quietly in the background, so nothing seems wrong.
A Short History
None of this is new, but it keeps getting bigger and more organized.
In 2022, researchers at Kaspersky found a bundle aimed at gamers looking for cheats that did something especially nasty: after infecting a victim, it stole their YouTube login and used the victim's own channel to upload more copies of the lure video. Every victim became a new distributor.
In early 2023, CloudSEK reported a 200 to 300 percent month-over-month rise in YouTube videos linking to information stealers, many of them "cracked software" tutorials narrated by AI-generated presenters who looked and sounded trustworthy.
In October 2025, Check Point Research described what it called the "YouTube Ghost Network," more than 3,000 malicious videos spread across hijacked and fake accounts. Some accounts posted the videos, others posted the download passwords and refreshed dead links, and others left the glowing comments and likes. Because the jobs were split up, banning one account barely slowed the network down.
That last point matches what I see every day. These are not lone pranksters. They are organized operations that plan for takedowns.
What I'm Seeing Right Now
Since mid-September, my monitoring has catalogued more than 12,000 suspected lure videos from about 4,300 channels. YouTube has removed a few hundred of them on its own. Most are still up.
Here's the key thing I've learned: taking down the video is not the only way to win. Taking down the link works just as well. A video that points to a dead page can't hurt anyone, no matter how many views it gets. And the link usually lives somewhere with a faster, more responsive abuse desk than YouTube's: a domain registrar, a web host, a file-sharing service, or a paste site.
So that's where I aim my reports.
The "Nightmare" Campaign
One operation advertised a cheat package called "Nightmare" across game after game: Valorant, Counter-Strike 2, Dead by Daylight, Arc Raiders, Minecraft, and more. Its videos all sent viewers to a website to download the cheat.
Since late September, I've watched that operation move through at least eight different web addresses, with names like Nightmare Loader and Nightmare Hub, each time a previous site went down. Its last home was scripts-zone.pro, linked from 495 videos across 10 channels.
I reported the domain to its registrar, PublicDomainRegistry, and on October 18 they acted on it. Every one of those 495 videos now points at a dead link. Counting all eight addresses, 732 videos from this one campaign have been cut off, and more than half of those videos are still sitting on YouTube today, harmless.
MediaFire
Today, the file-sharing service MediaFire acted on my reports against 14 shared folders that were serving game cheats: Roblox executors, Blox Fruits scripts, a GTA mod menu, and Valorant, Fortnite, and Counter-Strike 2 hacks.
Counting every MediaFire takedown since September, 316 YouTube videos across 76 channels now point at dead MediaFire links. MediaFire's own download counters showed today's 14 folders alone had been downloaded more than 92,000 times.
This one took weeks of back-and-forth, and it shows how these operations dodge detection:
Locked archives. The files were password-protected ZIP archives, with the password printed right in the video description. The lock isn't there to protect you. It's there so antivirus scanners can't look inside. Many of these files showed up as "clean" simply because nothing could read them.
Same program, different labels. In one batch, a dozen different "cheats" for five different games all contained the exact same program.
Instant replacements. When individual files were blocked, fresh copies appeared at the same folder links within minutes. That's why the folders and accounts are what matter, not the single files.
Altogether, about 1,900 lure videos from nearly 700 channels now lead nowhere because of takedowns like these.
What to Watch For
Most of these red flags come down to one idea: if a video is offering something that normally costs money, or that a game company actively bans, for free, the "free" thing is the product, and you're what's being paid with.
Watch for:
"Free," "undetected," "no key," "working 2026." Cheats, cracks, and unlimited currency are the bait in nearly every lure I see.
A password-protected download, with the password in the description. Legitimate software doesn't need to hide from your antivirus.
Instructions to turn off your antivirus or "allow" a warning. That warning is your computer trying to save you.
Links to file-sharing, paste, or shortener sites instead of the developer's own official website.
A suspicious comment section. All five-star praise with no real questions, near-identical comments, or comments turned off entirely.
A channel that doesn't match the video. A channel full of old cooking or travel videos that suddenly posts a Valorant hack has probably been hijacked.
Anything asking you to paste code into a crypto tool and then send funds. No YouTube video is going to hand you a money-printing trading bot.
A livestream promising to double any crypto you send, especially one featuring a famous founder or celebrity. These are always scams, and the "celebrity" is often an old clip or an AI fake.
Parents: game-cheat videos are aimed squarely at kids and teens. A short conversation about why "free Robux" and "free executors" are traps can save a family a lot of trouble. Kids often install these on a shared family computer, where the stolen passwords belong to the adults.
If You Already Downloaded Something
Don't panic, but act quickly:
Disconnect the computer from the internet.
From a different, clean device, change your important passwords, starting with your email, then banking, then Discord, Steam, Roblox, and anything else you care about.
Sign out of all sessions on those accounts. Information stealers take your logged-in browser sessions, which can let a criminal skip your password and your two-step verification entirely. Signing out everywhere cuts those stolen sessions off.
If you have a crypto wallet on that computer, move your funds to a brand-new wallet created on a clean device. Treat the old wallet as compromised.
Have the computer properly cleaned or reset. A quick scan isn't always enough for this kind of infection.
Reporting What You Find
If you come across one of these videos, report it on YouTube (under the three-dot menu, choose Report, then Spam or misleading and Scams or fraud). Don't click the link to "check it out."
I'll keep reporting the links behind them, and you can follow takedowns as they happen on my live threat intelligence dashboard.
And if you think you or someone in your family may have run one of these downloads, or your computer is acting strangely, reach out to Rising Sun Solutions. I'm happy to help you sort it out.
Comments