YouTube Creators Targeted in Global Phishing Campaign

Cloudsek warns of a global phishing campaign targeting over 200,000 YouTube creators that uses password-protected cloud-hosted archives containing malicious executables (linked to Lumma Stealer) to steal credentials and session cookies, hijack accounts, and amplify scams; the operation leverages extensive infrastructure—hundreds of SMTP servers, dozens of RDP systems and SOCKS5 proxies—and the vendor urges creators to verify senders, avoid untrusted downloads, enable 2FA, and monitor accounts for unauthorized activity.