Channel hijacking

The route is almost always the same. A convincing sponsorship offer arrives, the brief turns out to be an executable dressed as a PDF, and running it hands over the browser cookies that keep you signed in. Stolen cookies let an attacker in without the password or a second-factor code, which is why two-step verification on its own does not prevent this. The channel is then renamed, the videos hidden, and a crypto stream goes live under your subscriber count.

Defence is boring and it works: treat any sponsor asking you to download a file as hostile, open attachments in a sandbox, use a passkey or a hardware key, and check the active sessions list in your Google account so a stolen one can be revoked.