Best malware analysis YouTube channels in 2026

Most "best malware analysis channels" lists were written by people who have never watched a sample unpack itself in a debugger. They rank by subscriber count, pad the list to ten, and recommend the same names every SEO blog already recycled.

This is the honest version. We run a directory of these channels, so we actually watch them, and we sorted by what each one is genuinely good at, with one real caveat each. If you want the wider security picture beyond this niche, it's in the full roundup.

Be warned up front: serious malware analysis content is a small niche. There are maybe five channels worth your time, and that's fine. Depth beats a padded top ten. The overlap with reverse engineering is heavy too, so the best reverse engineering channels post is a natural companion read.

One non-negotiable before any of this. Do not detonate samples on a box you care about. Isolated VM, no host shares, no bridged networking unless you know exactly what you're doing, snapshots before every run. People have ransomwared their own labs because they got lazy about the network adapter. Watch these channels for technique, then practice on your own gear with your own guardrails.

The channels worth your time

OALabs is the deep end, and it's where serious analysts go. Sergei and Sean walk through real unpacking, manual and automated, the kind where you set a breakpoint after the loader hands off, dump the unpacked payload, and rebuild the PE headers so it actually loads in IDA. Config extraction from real families. C2 parsing. The x64dbg and IDA workflows are the genuine article, not a sanitized demo. If you want to understand how a packer actually defeats static analysis and how to beat it back, this is the channel. The honest caveat: it is not beginner-friendly, at all. If you don't already know what the IAT is or why a stolen-bytes trick breaks your unpacked dump, you'll be lost in the first ten minutes. Build fundamentals elsewhere first.

MalwareAnalysisForHedgehogs is the best sample-by-sample channel running. Karsten takes a real specimen, triages it, unpacks it, and writes a YARA rule, and he shows the whole chain instead of skipping the messy parts. The pacing is approachable without being dumbed down, which is a hard balance. This is the channel that teaches you the actual analyst loop: triage, identify the packer, unpack, extract behavior, write detection. If OALabs is the graduate seminar, this is the working class on how the job is done day to day. Caveat: the catalog is broad and not perfectly sequenced, so you'll bounce between difficulty levels rather than follow a tidy beginner-to-advanced path. Treat it as a reference library, not a course.

John Hammond is the most accessible entry point on this list, full stop. Python tooling, CTF energy, malware breakdowns explained for a wide audience without losing the actual substance. He'll take a malicious document or a sketchy installer and walk it apart with enough context that someone two months into this can follow along. The volume is high and the production keeps you watching, which matters when you're building a habit. Caveat: breadth over depth. He covers an enormous surface area, so you get the shape of a technique rather than the three-hour grind of fully reversing a packed binary. Use him to get hooked, then go deeper with OALabs or Hedgehogs.

cybercdh is Colin Hardy, and he's exceptionally clear on threat analysis and maldoc breakdowns. Malicious Office documents, obfuscated VBA, PowerShell loaders, the messy initial-access stuff that actually lands in inboxes. He explains the deobfuscation logically, step by step, so you understand why each layer peels the way it does. Strong threat intelligence framing too, connecting a sample to the broader campaign rather than treating it in isolation. Caveat: the upload cadence has been sparse, so think of it as a focused back catalog you mine rather than a channel you subscribe to for fresh weekly drops.

Mente Binária is the standout for Portuguese-language reverse engineering and malware content, and it's more than a channel, it's a community. Solid coverage of RE fundamentals, assembly, and malware internals, which is genuinely rare outside English. If Portuguese is your first language, or you just want to support non-English security education, this is the one. Caveat: the depth is uneven across topics and some of it assumes you'll plug into the wider community forums to fill gaps, so it works best as part of an ecosystem rather than a solo binge.

How to actually use these

Don't binge passively. Pull the sample family being discussed, set up your own isolated lab, and follow along in your own debugger. Pause when they hit a breakpoint and ask yourself what you'd do next before they show you. That's the difference between watching unpacking and being able to unpack.

And if your interest leans toward incident response and forensics rather than pure RE, the blue team and DFIR channels post covers the other side of the same coin: what you do once the malware is already inside.