How Threat Actors Exploit Brand Collaborations to Target Popular YouTube Channels

This report details a large-scale phishing campaign targeting businesses and YouTube creators by impersonating brands and sending password-protected archives hosted on OneDrive; extracted payloads (AutoIt-based executables and a RegAsm-injected .NET component) deploy a credential- and cookie-stealing infostealer linked to Lumma Stealer, communicating with identified C2 infrastructure and leaving multiple IoCs (file hashes, domains, IPs) and operational artifacts (SMTP accounts, stealer logs, automation tools).