Ghost Files 2026: The Truth Behind the Viral “Leaks”

New Delhi, March 5, 2026: In the fast-evolving landscape of 2026 digital culture, a new and more sinister trend has emerged under the moniker “Ghost Files.” While the term might sound like a paranormal investigation, it actually refers to a sophisticated wave of cyber-hoaxes and phishing scams that dominated social media throughout February 2026.

These “Ghost Files” capitalize on “leaked” celebrity content to lure unsuspecting users into data-harvesting traps. Here is a deep dive into the most viral—and dangerous—digital myths of the month.

1. The “Pinay Gold Medalist” Scandal: Zyan Cabrera

The most prominent “Ghost File” of February 2026 involved the so-called “Pinay Gold Medalist” video. This trend targeted Filipina creator Zyan Cabrera (popularly known as Jerriel Cry4zee).

The Hoax

Posts across X (formerly Twitter) and TikTok claimed that a “private video” or “MMS” involving a Filipina Olympic gold medalist had been leaked. These posts used high-engagement keywords and provocative thumbnails to drive clicks.

The Reality

• Fabricated Identity: Fact-checkers quickly confirmed that Zyan Cabrera is not a gold medalist; the title was entirely fabricated to add “prestige” and urgency to the clickbait.
• The Trap: Clicking the “Watch Full Video” links led users to spoofed streaming sites. These pages were designed to capture IP addresses or prompt users to “verify their age” by logging into a fake Facebook portal—a classic credential-phishing tactic.

2. ChiChi (Vera Hill) and the “Video Call” Trap

Following the Cabrera hoax, the same cyber-syndicate shifted its focus to Vera Hill, a lifestyle and travel influencer from Siargao, Philippines, known online as ChiChi.

The Scam Mechanics

Known as the “ChiChi Call” scam, this Ghost File utilized SEO Poisoning. Search engines were flooded with keyword-stuffed blogs promising “ChiChi Vera Hill Viral Link” and “ChiChi Private Video.”

The Danger

Cybersecurity analysts revealed that these links often attempted to install malicious browser plugins or APK files. Once installed, this “Ghost File” malware could:

• Log keystrokes to steal banking passwords.
• Intercept One-Time Passwords (OTPs) to bypass Two-Factor Authentication.
• Access private photo galleries for potential extortion.

3. Angel Nuzhar: The “12-Minute” Phishing Lure

In the latter half of February, the trend moved toward South Asia with the “Angel Nuzhar” (or Angel Nujhat) viral video claims.

Precision Baiting

Unlike generic titles, this scam used a specific timestamp—“12:34 Full Video”—to create a false sense of authenticity. Digital forensic experts noted that scammers are increasingly using specific durations to bypass user skepticism.

Verification

Investigations showed that “Angel Nuzhar” appears to be a completely synthetic identity or a typo-trap created specifically for this SEO campaign. There is no verified creator by this name with leaked content; the name exists solely as a vessel for distributing malware.

How the “Ghost File” Syndicate Operates

According to cybersecurity reports from early 2026, these are not isolated incidents but part of an organized cybercrime system operating across Southeast Asia and India.

Tactic	Description
SEO Poisoning	Dominating Google and TikTok search results with fake “video link” pages.
Redirect Loops	Forcing users through multiple ads to generate revenue before hitting a phishing wall.
Deepfake Thumbnails	Using AI-generated or heavily edited images to “prove” the video exists.
Urgency Messaging	Using phrases like “Watch before it’s deleted” to bypass critical thinking.

Staying Safe: The Digital Hygiene Checklist

The rise of the February 2026 Ghost Files serves as a reminder that curiosity is the primary vector for cybercrime.

• Avoid “Leaked” Links: No legitimate video platform requires a social media login or a plugin download to view content.
• Check File Extensions: If a “video” asks you to download a .apk, .exe, or .zip file, it is malware.
• Report, Don’t Share: Sharing these links, even to “warn” others, can sometimes be a legal offense under the Information Technology Act if the content is deemed non-consensual or deepfake-based.