This channel was not hacked. I NEED HELP. My channel is about to get terminated. I can't upload any videos for a week. Here's the overview of the situation from my second channel:

https://www.youtube.com/watch?v=AZfNtTLnFtk

i swear youtubes getting worse and worse... by 2030 there would be no channel on youtube xd

Damn, I YouTube doesn't care a bout bots and scamming, but it cares about destroying channels. I hope everything will be good with Your channel. Good luck

Well, R.I.P to this channel, it was a good run

@@Yarpopcat08they do care about scams but they don't put enough effort into it, i reported one and it was gone in a day but that was one out of the millions of scam channels

Welp, this happened to other yt creators before, you're not the only one who is having problems in the ytverse.

I Really Hope It Doesn't Get Terminated Because This Chanel Helped Me With A Lot Of Things And It's Just Fun To Watch, But BTW How Did You Upload This Video If You Cant Upload Any Videos For A Week

youtube be like<br>yeah let's just be Solaris and remove every YouTube channel that has a letter in the name

youtube be like
yeah let's just be Solaris and remove every YouTube channel that has a letter in the name

@@Yarpopcat08 ironically they care about destroying channels that are actually trying to mess with bots and viruses, just remember his "TrustedNOTInstaller"

@@JacksonGaming092 Can You Stop Doing This. But like seriously though, its stupid.

@@JacksonGaming092 You capitalized every word, alright.

@@dark-mode. it's because maybe I don't care about doing every single thing right

@@JacksonGaming092  Aight, do your thing. I should not too off topic.

Enderman, i am gonna upload the video to my channel, Please allow me copyright... it won't lemme because its copyright, allow me so i can help you as much as i can, i've been your fan for years now

I seen that video<br>I'm so sorry that YouTube removed your video

I seen that video
I'm so sorry that YouTube removed your video

@@hgijhsjos6288 Or 80% would become like me by uploading bad things

@@BeatBoandDJStar2010 gg, youtube removed that video TOO

im watching many of these vids bc im gonna miss u

Canadadrew 3mil subs got hacked and has a livestream about peepeecoin

What's your second channel? The video is gone.

hey the video got tooken down for violating the rules

I wanted to see the second channel video but instead it said “This video has been removed for violating YouTube’s Terms of Service”😭

Youtube took the explanation video down. I know that now your channel may not be at risk, but it is SOO annoying that they just take it down for no reason.


Pretty sure they literally deepfaked Sundar there

True. It looks like the deepfake's lips don't even sync to the audio, and even then, the audio is quite not very natural.

They 100% did, if you look closer the lips at times look incorrect, but it's very well concealed with low quality

@@Endermanch wassup, been subbed for a few weeks. i like your geometry dash music taste lol

Hi ThioJoe. And well.. the email itself is already very sus by the way it's written. Looks like it was written by a teenager or something. Also having attachments... Makes it way more sus. I know official YouTube emails and they never attach files or warn about limitations. Also what if you try to run this on a Linux or Mac system? I bet the scammers think that everyone runs windows, which is false.

I don't need to watch the fake video to notice of fake everything it is. The email itself and the video description already can make your common sense alarms go haywire.

@ThioJoe Btw, glad Linus Sebastian and co gave you credit for the scam video. You deserve it.

key thing. when there are pauses in the speech, he continues talking so I think that the recording is from an older video

Large channel I've never seen comment before actually comments on a smaller channel within 2 hrs of upload.

That's really cool

they did, at 5:55 his mouth looks very weird, and the overall movements are pretty obviously deepfaked

Yeah, it was literally a deepfake. They probably deepfaked the deepfake to make it more real.

Also 1 more red flag that was already noticeable:

If Google/YouTube officially released new change on terms, policy and rules, pretty sure their videos about it are 100% set for public instead of being privated/unlisted

aren't you the guy who literally scammed your viewers by making up shtty lies?

Even so, this is actually pretty bad. I fear the worst.

Yeah they did. watch his lips and the voice. it doesn't match sometimes. anyway, everything on this video screams red flags

@@Endermanch ThioJoe gave you a nice shout-out (and link) in his video on this. It's the reason I'm here, and I'm sure I'm not the only one.

The face might not be deepfaked but the voice yes. I never heard the CEO talk so I cannot confirm if the voice has been AI modified but for the lipsynch, it looks like something like wav2lip. But yeah, this fake video is poorly made.

@@Endermanch I agree as I get spammed alot

Holy shot it’s Sherlock Holmes 💀💀

No shot

Commenting on a video with thousands of subs must be hell


It's actually not a keystroke logger. When you run the file, it steals the browser cookies that keep you logged into YouTube. Once the scammers have the cookies, they can put them into their browser and have access to your account without a password or 2FA. They then change the password and 2FA, and you have lost your account. It's quite effective once the victim falls for the scam.

Some different variations don't steal your browser history or any of that. They steal your cookies and session key, which lets them login even if the password gets changed.

It's basically a YouTube cookie logger. I am safe, I don't use YouTube enough.

@@tubbunny so how do you get rid  of it?

@@tubbunny so how do you get rid  of it?

No matter the variations what the scammers are trying to get at is a session token/key for your account; that is how they would bypass the 2fa.

@@TheBedLump_Sans i dont even read my mails

Exactly what I thought after seeing this while before linus got hacked channels

@@patrickboyd8937 only way is to never click on "Remeber me", that's it.

I don't know how that works in the US, but at least in Europe, I always had to prove my identity by inputting my password for stuff like changing password, so that wouldn't really work for me being European. Anyway, I know that this isn't how it works and the title clearly says "shares a video with you" - YouTube would never put something like this in a video with Google CEO (if anything, YouTube CEO would make much more sense). Knowing corporate shit, changes to corporation user policies happen more in a stealthy manner, where they silently update the policies page and then just send out emails prompting users to take a look at the new updated policies (which most people won't even do). They don't even conveniently link to the policies, just "search it up" (why make it convenient, right?). So scams like this would NEVER really work for someone who is familiar with policy updates from corporations like YouTube. Plus, this is the first time I see they forgot to remove the access to the video (so you can't just flag and report it as a scam to YouTube - because even if you set the video as private, it is still subject for community guidelines and if it violates them, then it doesn't matter the video is private, it can still be reported and removed for guidelines violation - although even if the video access is removed, the URL isn't, and you can report the URL to YouTube, so in its way it achieves nothing, just a mild inconveniece). They remove the access to the video once the email is sent (i.e. the user is notified), so the video is inaccessible, but the email is still there, including the full video description, which pretends to be an official message.

That’s pretty understandable that they try to steal a cookie session but how do they change the password without access to the old password? When you try to change your Google Account Password, you’ll first be prompted to enter your old password. Oh shit, wait! If they could access Gmail from the cookie, then they could reset your password without the old one 👀

@@raaymonf ur crazy if u think youtube is all they get access to. if u have sessions for a crypto exchange, ur email, or a bank they can waltz right in to those without logging in.

How do they change the password with only cookies? YouTube requires the old password to change the password even once you're logged in.

So that's how they stole people channels by sending the file to scam them!

@@__Razer If the password is stored on autofill, they can use inspct elements to make the password visible, or just copy the text and paste on any text editor, if the site doesnt stop you from copying passwords

Tldr: Why can't they bind the cookie to IP address...

 and/or User Agent? If both change, the cookie is invalidated, but if one changes, it might or might not be, depending on security policy.

basically if you fall for this trick the only way to save your account is deleting all cookies and deleting every trace of the program and then running a virus scan, THEN logging back in

Something similar is going around on discord, but with an actual keylogger

I recently got got by one of these, luckily they did not change the password or 2FA, which is how I'm still here today.

@@actuallypositival_ if you change your Google/YouTube password it will log you out of your other devices.

@@ql440same, but even if someone reads email whos going to run a suspicious, 680mb file, and marked as "pdf" when its .scr


We need a petition to make a major policy to never open email files unless requested on most sites.

Not clicking links or opening attachments is good practice. When I order stuff online, I always log into my account at the shop and download the receipt there.


I would find it odd that the CEO of Google and Alphabet reaching out to their creators. Pretty sure Sundar Pichai would have more important things than to make this video. However, CEO of YouTube is currently Neal Mohan. It would be Neal's responsibility for overseeing YouTube.

@@user-ck1rx1yn7n Since about a month ago.

@@user-ck1rx1yn7n she stepped down and now we have the person who got dislikes removed and pushed for nfts on youtube as ceo

No he didn't. Dislikes were been removed earlier when Susan was the CEO.

@@sofiaknyazeva CEO isn't the only person who does things and comes up with ideas at a company you know?


I REALLY HOPE YOUR CHANNEL DOESN’T GET TAKEN DOWN I’VE LEARNED SO MUCH😭😭😭🥺🥺

It would just be very sad if they took his channel down like that..

Yeah, I Am A Really Nerdy Person And These Videos Inspired Me To Be, They Were Funny And I Liked Learning About New Stuff Every Day He Uploaded A VIdeo

I would cry non-stop if Enderman was banned


Wow the CEO himself made a video about the monetization policy change. What a dedicated man.

lol if that actually was legit it would be put on godly rarity


(1:19) I remember seeing a similar thing happen where Google Drive was being abused instead of YouTube. Gmall were smart enough to file those as junk mail as they were sent to many random Gmail addresses.

I get some [REDACTED] pdfs files, of certain things for no reasons in my email

@@catminer7436 hey, a fellow [big shot]<br>what exactly is [in there]

@@catminer7436 hey, a fellow [big shot]
what exactly is [in there]

@@funduck2015 let's say it was some NSFW things


I'm sorry about it. I have been watching your videos for 3 years or so since the COVID-19 lockdown, your videos were really entertaining and educational at the same time. Due to college tests starting from next Saturday, I haven't watched your videos for a while. I hope it will be resolved.


Their deepfake of Sundar changes from a British accent to an American accent halfway through

Such scams feel so legitimate and well as long as they don't screw up over small things like theze


Everybody: fears that their channel could get hacked<br>Enderman: AHH YES, FINALLY, A SCAM MAIL!

Everybody: fears that their channel could get hacked
Enderman: AHH YES, FINALLY, A SCAM MAIL!

https://www.youtube.com/watch?v=AZfNtTLnFtk
The scammers did know the time that he was going to be striked.


"Download document for Windows"
People that have Linux: 0:19


14:00 You can likely use a Hex Editor like HxD instead to remove a bunch of empty bytes (assuming that's what is inflating the file size).

ok thank you information that we totally needed to know 100%

this is actually helpful information thanks

You can't, it's garbage data in there. I specifically said it was garbage, not null padding since it could be an embedded resource which you wouldn't be able to safely remove using HxD.

@@Endermanch Random bytes are not compressible at all because their entropy would be near infinite. But you have seen 7z had less than 1% of the file left when compressing. So it's some pattern that's just repeating over and over again being compressed away using the dictionary of LZMA2.

@@kyoudaiken that's what I meant. But it's hard to understand where that pattern starts in the hex editor

It actually IS the reason why it's so big (that's what she said)

@@Endermanch Doesn't usually the PE header give a clue where the executable ends? Maybe you are safe to remove the last 30 MByte.

@@Endermanch Of topic and I'm not syaing I'm expert, but most Linux channels when they analyses these files they just eith use head command / pipe to cut the file to the level where it garbage data started .


It's actually pretty scary to see what hackers/scammers can do these days, wow...

This isn't that well set up but yeah -- they could've done better

@@UCyAn7sD-VHF2H9KDasGpUng i would definitely believe that

They even use similar looking characters called "cyrillic characters" to impersonate official e-mail addresses, so most people couldn't spot any difference unless they do some checking using the "unicode identifier"

It's going to get exponentially worse, and soon. I feel bad for all of the average people out there who aren't very tech-literate.

@@THE-X-Force man me too, I just trying to find a biofuel quote and google showed it as the first then BOOM. Microsoft scam security. Terrible afternoon


I hate it when cybercriminals try to impersonate a real company

What's your preferred method of getting scammed?

Someone had impersonated me on YouTube <br>But I reported him and he got terminated

Someone had impersonated me on YouTube
But I reported him and he got terminated


11:45 also deactivate from any other login session using the non-infected device (a phone for eg). The stealer uploads session cookies which works in some site even after password change.


Я не могу не пожелать тебе удачи выжить в этом недоразумении Ютуба. Ты стал жертвой людей, которые ради своей забавы хотят удалить все твои каналы, думая, что они всесильные. Справедливость должна восторжествовать, и я надеюсь, что  <br>этой ситуации дадут больше внимания.

Я не могу не пожелать тебе удачи выжить в этом недоразумении Ютуба. Ты стал жертвой людей, которые ради своей забавы хотят удалить все твои каналы, думая, что они всесильные. Справедливость должна восторжествовать, и я надеюсь, что
этой ситуации дадут больше внимания.


How are they sending emails from the YouTube domain? Also, so much for the "Scanned by Gmail" feature doing absolutely nothing regarding this. With a company as large as Google you'd think they could run a virus check for larger files. Of course though scammers will just artificially increase the file size even more to combat that.

I actually found the answer to this question from a comment in another video. I'll copy and paste it here for convivence.

Original Commenter: Ignelis
Comment Source: "The Latest YouTube Malware Scam" from John Hammond

"Hi John, they used a share function in Youtube. So they have a private video, so you can't see it, but the thing with private videos is that you can give access to someone. So they add your and other youtubers emails, so you would get this email from youtube, stating that this and this channel shared a video with you. In the email you can see description and title of the video. Once you receive that email - the scammers just remove access so you can't see it, that's why it says the video is private, but you got email from official youtube domain."

@@GavAttackO but then how would the archive get attached to that e-mail?

@@realcomputerdude100 its in the description of the video?

@@amongsussyballs I've never heard of being able to attach a file inside the description of a YouTube video.

A link to the file, I could understand. But the file was attached in the e-mail.

@@amongsussyballs I've never heard of being able to attach a file inside the description of a YouTube video.

A link to the file, I could understand. But the file was attached *in the e-mail.*

@@Endermanch i still no get it sir,, like how they can attach that file with mail

@@Endermanch Unless I'm oblivious I only hear it mentioned once and not brought into any further detail outside of 'it's unfortunate that sharing videos with others is similar to YouTube creator notifications', something along the lines of that.

@@GavAttackO True, I could've explained it better. I thought it was obvious, my bad

@@GavAttackO I'm glad I'm not alone, I thought I was losing it! 🤣

@@realcomputerdude100 I think gmail will attach google drive files to the e-mail if there is a link to the file somewhere within the e-mail? I could be wrong though

@@papajohnscookie that was the only other possibility I could think of, some kinda automation there.

@@papajohnscookie yes, it's automatic: if you share a legit Drive link, Gmail will also show it as an attachment to easily download it without going on Drive - so this email is "legit", it's the video they shared that contained malware and with that video and that crafted description they basically exploited the Gmail automation

@@HaRsH-GoR They put file on google drive. File is encrypted so it can't check it.

@@Rikysonic thank you for the explanation!

Gmail is NOT safe they sell your data to scammers.

@@papajohnscookie I think you are right. But only for Google drive files since Google can actually access them.


Works this virus file on IOS? Or only windows?


You might also want to pin a comment with the video here. If that's even possible...
I'm not sure abt the editing rights, but you could also add a "showcasing purposes only" disclaimer into every description, maybe that influences the algorithm.
Good luck, let's hope there will be a real human looking over it before they can terminate you and your communication attempts are more than speaking to a wall.


5:22 no way the "youtube team" would have only 700 subs

tbh the scariest part is that 700 people were tricked into thinking it's real and subbing to it, or it could be botted


Stupid me downloaded the thing because I was scared of loosing monetization ( I know im stupid). I opened the zip but did not touch the document in it. My question now, am I safe or did it already infest my system?

@@violentvincentplus Just changed all my passwords on another computer. Hope that helps.

@@PaddyPatrone Did you open it. If not, you we're completely fine.


We need Linus Sebastian and LMG to watch this now.

Btw, run it on a Linux or Mac system with wine to see what it can do.

"hey, if you do not sign the document you are banned from Youtube, also we do not have a linux/mac version"

I would love to see the OSFirstTimer guy try the latter! After all, he did respond to phone-based tech support scams that say his Windows computer has a virus, saying "Sorry, I use Ubuntu".

@@yliassloudtech348 i can't as I don't have windows and I wouldn't as ik what it does.

It probably won't do anything. Highly doubt the malware is designed to work on wine.

@@hunterzone4846 perhaps. But i would still like to see what it can do. Someone managed to run memz on wine and something happened


Somehow this isn’t official, it’s a fake message which is a scam.


I wonder if they shared a private video with the description as the scam message. Would make sense why it says Shared a video with you


ayo! nice video. i miss sometimes old video type like showing how virus works (like petya).<br>i still like this type but would be cool to see more malware videos!

ayo! nice video. i miss sometimes old video type like showing how virus works (like petya).
i still like this type but would be cool to see more malware videos!


We should be able to set an anti-phishing code/passphrase on sites, so that when a real email comes from the company it contains this code. If it does not contain the passphrase we set, it should ring a bell that it’s a phishing/scam email.

This isn't anything private, but usually, that would be your YouTube channel name in this case, to at least prove its for you and not just spam.


.scr also prevents window's smartscreen from coming up when running it.

Time to make this extension non-executable in the registry.


I noticed after a while that I hadn't gotten any notifications from Youtube about you uploading. That alone had me a little bummed. But when i saw the title to this video. My heart truly started to melt. I absolutely love your videos and simply the thought of your channel being terminated brings a tear to my eye. Hope you get through this with your channel still in tack. I wish only the best for you Andrew 🙏


Notice the "confirm=no_antivirus" in the URL. Wonder what that does 🤔.

it skips the antivirus prompt that google drive has

@@yotoprules9361 I know what it does… I was making a joke.


Starting to think YouTube should move communications to YouTube studio


Just a note, the email is actually from YouTube, it's using the share feature to send a video containing that malicious link


It's time for a class action lawsuit against YouTube/Google. No mentally stable person would share a video using the share function via email. This makes no sense. Yes it's a feature from the late 2000s but still... This really feels like negligence. Why did this not have been removed years ago?


That's some next-level trickery right there


hey enderman i noticed this youtube team account only has 719 subscribers


The "Anti-anti VM" i didnt expected that XD


BTW if You look at the subscriber count, and see that it's fake.  Also I don't know they would private the video, they have them public and I would also compare the name (not the display name but the name with the @) with the real and fake YouTube channel.


Screensaver? For me those are AutoCAD scripts. 😉


hey everyone he has 1 strike WE NED TO HELP HIM NOW<br>pls if u can pin it

hey everyone he has 1 strike WE NED TO HELP HIM NOW
pls if u can pin it


I witnessed something similar back in February 22 of that year. This time, it's with Playrix's job inquiry through DeviantArt's Chat.


i'd like to see the malware! (also i thought you used chrome not edge lol)


But HOW? Google doesn't let you make an account with the same email as another account! How did they bypass this?

The scammer created a channel called YouTube Team and uploaded a deepfake AI video with the text of the email in the video description. Then they use the share function from YouTube to send it to their possible victims. That's why the sender looks legit because it comes from YouTube itself. The email contains the text of the video description and the layout YouTube uses is the same layout they use for official emails. To me, this looks like negligence from Google/YouTube and they should be sued for this.


Why does Windows never show extensions by default


That's why do I think that LTTs rented out their account.


Enderman's the type of guy to install windows 11 on a potato


The deep-faking levels here are scary. I think deep-fakes should be illegal.

And I like making SpongeBob say the n word

i mean it's only really viable for memes and stuff apart from this, but if you have a keen eye, you would see that the channel isn't official either way

I can see the channel’s fake, but the deepfake is scarily fake.

I AGREE 100%<br>AI generated videos and pictures absolutely creep me out, no matter how perfect they may be.

I AGREE 100%
AI generated videos and pictures absolutely creep me out, no matter how perfect they may be.


Wouldn't mind proposing a new notification format for private video sharing to YouTube so it differs from the official messages a lot (this way you can clearly distinguish a video share at a first glance). I am pretty skilled with basic HTML/CSS, so I can compose a new email layout for this.


That's why all my friends in youtube has a backup channel in odysee, rumble and tilvids


I already saw something wrong as the file protected as said in the email. Just a rules and policies document why they need to encrypt it

Well, that's called common sense, you got the common sense that it automatically flagged your suspicion into a big BS alarm


When YOU don't TUBE the YOUTUBE, you get scammed. Stay safe guys.


i might be thinking too simple about this, but can't MS just warn users like if theres a . followed by 3 letters in the name before the actual extention?


Ah yes, I love when YouTube Team shares a video with me on YouTube.<br>This video's good to make me forget about polynomials assignment I've got to do.

Ah yes, I love when YouTube Team shares a video with me on YouTube.
This video's good to make me forget about polynomials assignment I've got to do.


If the ceo of Google sent me a video about the policies of YouTube changing I wouldn't believe that in the first place


How did you not instantly notice it was a deepfake bruh

I didn't either on first watch, I wasn't really paying close attention but looking back you can notice

Not even a good quality one, the voice sounds so robotic.


Have you uploaded it to the github repository? i'd like to take a look at it.


"no ones gonna run this file"

i wonder to what happend to linus drop tips


If you listen and look closer at the last bit of the video of the CEO of Google, you can tell it was a voice over the original. His mouth movement and what is said in audio doesn't match.


5:10 if you pay attention to the guy's lips you can see that its not syncing with the voice. giant red flag


Cool video. I had a video idea that is impossible. Install windows on a hdmi cord


I don't understand how almost every scam has bad grammar which gives it away.


Next video pls! Downloading malware on MacBook


Finally a chad who has the taskbar on the top


Now we gotta develop a scanner that can scan files that are under 1GB in size.


When some russian guy (probably with one of his arms broken) has to tell you not to execute files from e-mails, there is something wrong you had just done.


Silver Chariot Requiem is always a problem 😂


One way to prevent getting tricked by this type of scam is changing the way .scr files are opened. Create a new action for the scr and set it as default. For me, i created action 'open2' and set it to open 'notepad.exe "c:\Users\Public\screensaver_warning.txt"'. Windows will still launch screen savers normally, just the user will not. Also by right clicking it, you can still launch it using 'Test' action.


I see what they did. They shared a video via email.


Even since I haven't got anything, looks like I'm good for a moment. Thanks for alerting us!


Hey Enderman, I have a idea. Making an Windows based OS that just launches a program and that's it, and you cant do anything else. We will use Windows PE For this process, I have tried so many times but i get the same error or just bigger errors and i don't have enough brain for it. This is how i imagined: Windows PE Launches from ISO/any boot-able Source, Installs necessary files as like system32 and the libraries, Installs some drivers for the program to run at all, Restarts. Launches the Program and that's it. Could please do a topic on This?


mrbeast, e-mails, deepfakes, youtube scammers find every possible way to scam


random question but do you think you'll ever make merch?


dannggggg they tried to hide that harddddd


Hello which software you use to trace that file exicutive location plz tell i mean which software you use to find that virus location


I was listening to one of my playlists on spotify, and I heard your intro music! Is it Drive Slow - Windows 96? Anyways, I love your videos and they have inspired me when creating code. I hope to keep watching your vids. <3


So, basically, the entire premise of this scam consists of assuming that the file is a PDF file, just because it comes packaged with a PDF icon in the executable. This is combined with completely ignoring the simple fact that this so called "PDF" file just happens to have a .scr extension.


I just noticed that Enderman is using edge 🧐


Big companys like google, youtube(owned by google), amazon, facebook, ... should really just sign their outgoing email using SSL certificates, that user can just look for the little checkmark (or however the users email program/website/app shows it) to see wheter or not the email is real or fake, just like the litle padlock in the browser. But for some reason nobody using SSL email certificates. Wouldn't help in this case but it would help against some types of email spoofing (where they just change the sender adress)


Can you do "Upgrading" from Windows Longhorn to Windows XP?<br>(it requires a special application called "Application Verifier")

Can you do "Upgrading" from Windows Longhorn to Windows XP?
(it requires a special application called "Application Verifier")


notice how the description is unupdated that’s great.


The download link from Drive has "no_antivirus"... Is it the imposter?


I remember GroovyDominoes52 being scammed by a similar scam.

BTW, I'm using Windows 10 22H2, an OS I highly regret using.


YouTube if you see this, Dont terminate Enderman. (pin this)


Whatever his mouth moves separate to his voice sounds


12:46 thats .NET framework (it is just launching that because that scr was a .NET app)


Did receive one of these scam emails though, but I knew those were not real because they are sending a file... Youtube dont do that...

yes , unless if we ask for it , as what he said


i love your channel, I hope you don't get taken down


Amazing work to disclose the work of these bad people!


That was such an ai voice in Sundar lol 7:11


Enderman my brother, you need more information to really get what was going on. But you did partially correct


Bruhhhh he dubbed the clipped, Listen to the Audio and watch his lips. Scammers tried to lipsync his short clip


Ah, a YouTuber I watch, The Bread Pirate, recently fell for this one. His channel was FOX News for a little while.


these scammers always thinks that they can get away with their actions lol


is this right? generate me 30 sets of strings in the form of "xxxyy-OEM-NNNNNNN-zzzzz" where "xxx" is day of the year between 001 and 366 (for example, 192 = 10th july) and "yy" is the year (for example, 94=1994). your range is from the first day of 1995 to the last day of 2003. "OEM" mus remain intact the "NNNNNNN" segment consist of digits and must start with 2 zeroes. the rest of the numbers can be anything as long as their sum is divisible by 7 with no remainder. the last segment "zzzzz" should consist of random numbers. "z" representing a number.


what happened to your "limbo free download" video?


"720p can't see crap"

happily watches in 144p, since my internet is too slow for anything higher

"720p can't see crap"

*happily watches in 144p, since my internet is too slow for anything higher*

I have full ram and BOINC on all cores and gpu, so when youtube unswaps, it reduces quality.


He is right be aware on what you do on the internet


I wouldn't click on a google drive link that contains export=download&confirm= no_antivirus
Like bruh, what would you think that a link with "no_antivirus" would do??

I wouldn't click on a google drive link that contains export=download&confirm= *no_antivirus*
Like bruh, what would you think that a link with "no_antivirus" would do??


well in this cakes, i shall rename the cookies into pancakes<br>now that's a pastry joke my friends

well in this cakes, i shall rename the cookies into pancakes
now that's a pastry joke my friends


pretty sure the YouTube Team channel is not verified too also.


Firstly: WHAT YOUTUBE😡!!!!!!. Secondly: why is this happening!😮


So did he trashed that phishing e-mail or not?! (I also got a phishing e-mail on my Gmail too yesterday!)


I’d definitely get scammed if i received it


Naming a Youtube channel Youtube should not be permitted in the first place


Everybody gangsta until Enderman starts using MS Edge.

He is to lazy to install another browser on a vm.


Hii sir i have already double click scr file received in mail now my pc restarting problem every 5 min.i run all type scan Malwarebytes or windows defender but not threats detection so now what can i do?
Can i find where is scr virus installed in my folder??
Help me


How they are faking the YouTube mail address


linus  tech tips got hacked like that like 12 days ago


you are now using edge as your browser???


Will you update to Windows 11 and what do you think of it?

He did, but uninstalled it and his thinks its shi-


If not for the 380mb pdf (hahah just why?), I would not notice this is a scam at all.
MIGHT have been easier just to put an URL to a malicious website that redirects you to a real pdf anyways.
Honestly, this just feels like something someone was paid for to target a certain person.


I have a question:

If I download a virus that steals my data and uploads it to the user and run the virus, will it work if my internet is disconnected?

You mean "If my internet is disconnected, the attacker will be able to steal my data". If you mean that, the answer is no.


yes hi it is me from the live chat the code is not finished (for the project i accidentally pasted)


Something I’ve always wondered, well actually 2 things related to malware. Number 1. Why do some pieces of malware have anti VM in place? Whats even the purpose? 2. Not mentioned in the video, but I heard it somewhere. Apparently, there’s a select number of pieces of ransomware that have a kill switch, be run on a computer in Russia. Usually done by seeing if Russian is an installed language. While it’s great to have such a thing, why does it even exist? Ok, this one has nothing to do with the video, but I still want to know. If anyone has answers for either one, then let me know plz. Thanks.

For the first one I think it is to prevent the malware from being analized by an organization or individual, and also to motivate users to run it on their actual machine

1. So the malware has a higher chance of infecting an actual machine. Alongside preventing channels like Enderman from showcasing them, making removal videos etc. (That's a guess, so take that info with a bit of salt) 2. I would assume that its because the creators of malware don't want the viruses to run on certain devices. Let's take your Russian example:

If a Russian malware developer were to make malware that is supposed to inconvenience the western countries, the developer wouldn't want it to backfire against its own country so they code a kill-switch in to prevent it.

As for your first question; What is the point of a VM? VM is short for Virtual Machine. It's a way to run a program that usually you have made for testing it out. You as the developer of this software don't want to accidentally kill your box so you run a VM. It will kill the VM instead if you screwed up your code somewhere. Same goes for malware; Run it in a VM and your box is UN-affected. If it's destroying your VM you can always reset it back to it's known good state. Malware is designed to either make you pay for something you will never receive or just be mean and destroy your PC. Some are called Ransomware. Those as the name implies encrypts your files and the person who did it has the ability to decrypt them if you pay them a lump sum of money. Lately it's in Bitcoin or some other crypto-currency. But in this video the YouTube scam is to hack into as many accounts as possible and lock them down. Most likely for money. Install this little bit of Malware; run it and in the background it's tracking everything from your screen to what key's your using on your keyboard. That's how Linus got hacked. An employee of his opened up of these emails thinking it was a real sponsorship deal they had to read the terms of and next thing you know they got into his YT account.

anti-vm/sandbox is so that people can't analyze it (just use an old airgapped pc/maybe kvm if so), and the 2nd could be personal transgressions or simply targeting a specific country, like how virus sites give specific ips specific payloads

vm (mostly) allow the file to be executed in sandbox environment. They can analyze its behavior and allow it to infect a virtual os without exposing their real OS. This way any gathered data of the malware behavior will remain intact even if the virtual system is corrupted and destroyed. And they can use the gathered data for better security improvements, better database for anitivrus and patch fixes by exposing vulnerabilities. <br>So if a malware wont run in VM, it makes it difficult analyzing its behavior but also running batches of testing.

vm (mostly) allow the file to be executed in sandbox environment. They can analyze its behavior and allow it to infect a virtual os without exposing their real OS. This way any gathered data of the malware behavior will remain intact even if the virtual system is corrupted and destroyed. And they can use the gathered data for better security improvements, better database for anitivrus and patch fixes by exposing vulnerabilities.
So if a malware wont run in VM, it makes it difficult analyzing its behavior but also running batches of testing.


amazingly, none of my ~500 subscriptions has been hacked and name changed to Tesla


Do you use edge as your personal browser?


How to deal with scammers:😂 don't anwser


I got that email. Glad I don't read them, unless I know I did something to get the email.


Эндермен пошел в гдшерство!!!! Вернам гордится им


8:37 I will boot my anti-anti-VM machine.


Hello, I have vmware workstation 17.1, when I turn on the virtual machine, the vmware logo does not appear when I press the esc key to go to BIOS, that is, I installed Windows XP, the Windows logo does not appear, the welcome message appears directly.


Твои видео очень хороши, я буду смотреть каждое из них :D

i am learning russian so some letters may be misspelled or inaccurate

According to Google translate your Russian is fine! Good luck on your journey learning it!


you were absolutely hating microsoft edge and now you are using it. why?


i also saw a small korean channel get hacked too 😥


Do more appeal requests so they can see it


Him: Edge sucks!
Also him: Uses Edge in the Video.
Me: Bruh?!


What about the mrbeast 1000$ scam ad that has been going for years on youtube.


the bad thing is it doesnt have mobile app (play store one is just webbrowser)


Can you use Nk-Classical this music in next video?


Erpic failed against Harmony Endpoint lol


What is your computer ram ,, and what your CPU ,,


Hey Enderman! How about tweaking a Windows 11 Home Edition to Pro edition as your next video?


This scam had more red-flags than a construction site. 😒

🚩 Even non-native English-speakers can recognize the terrible language in the email (even in this version which is different from an earlier version which was even worse such as saying "getting monetization" and having dashes on the list of restrictions).
🚩 The deep-fake is terrible. That was NOT Sundar Pichai's voice; he has an Indian accent because he grew up in India and only went to the US as an adult, the deep-fake voice sounded robo-American with hints of British. 🤨 🤦
🚩 YOUTUBE/GOOGLE has a video that tops out at 720p? 😂
🚩 Why would Sundar handle YouTube stuff? He deals with Alphabet stuff and to a lesser degree, Google stuff. He leaves most YT stuff to the YT CEO. He just handed it off to a fellow Indian guy (like most American companies), so why would he do it himself? 🙄
🚩 So… they used the SAME PASSWORD for EVERY file and then put the password in clear-text in the description of a YT video? And that makes sense to people? 🤨
🚩 Google knows everything about you, they have ALL your data. They wouldn't send an English email to everybody, they'd send one in the language you specified is your native language. Enderman would get a Russian email, not an English one (if it was actually from Google).
🚩 The drastic difference in filesize with compressed size means either the dev was so incompetent, they bloated it beyond even the laziest game-developer's abilities, or it's artificially padded with lots of nulls. (To be fair, that could actually be the work of YouTube since they're so garbage at their jobs.)
🚩 WTF has ever seen a 700mb PDF file? 🙄
🚩 Overly-large files can't get scanned by cloud anti-virus but CAN be scanned by local AV programs.

I'd like to think that even non-tech-savvy people would notice at least one of the red-flags, but alas, I know better. 🤦

How did the dropper put files under the Windows directory without elevation? 🤨 This is partly on Microsoft, a fresh Windows install should never have new accounts running with admin privileges, they should always default to user-accounts. Duh. 😒

This scam had more red-flags than a construction site. 😒

🚩 Even non-native English-speakers can recognize the terrible language in the email (even in this version which is different from an earlier version which was even worse such as saying "getting monetization" and having dashes on the list of restrictions).
🚩 The deep-fake is terrible. That was NOT Sundar Pichai's voice; he has an Indian accent because he grew up in India and only went to the US as an adult, the deep-fake voice sounded robo-American with hints of British. 🤨 🤦
🚩 YOUTUBE/GOOGLE has a video that tops out at 720p? 😂
🚩 Why would Sundar handle YouTube stuff? He deals with Alphabet stuff and to a lesser degree, Google stuff. He leaves most YT stuff to the YT CEO. He _just_ handed it off to a fellow Indian guy (like most American companies), so why would he do it himself? 🙄
🚩 So… they used the SAME PASSWORD for EVERY file and then put the password in clear-text in the description of a YT video? And that makes sense to people? 🤨
🚩 Google knows everything about you, they have ALL your data. They wouldn't send an English email to everybody, they'd send one in the language you specified is your native language. Enderman would get a Russian email, not an English one (if it was actually from Google).
🚩 The drastic difference in filesize with compressed size means either the dev was so incompetent, they bloated it beyond even the laziest game-developer's abilities, or it's artificially padded with _lots_ of nulls. (To be fair, that _could_ actually be the work of YouTube since they're so garbage at their jobs.)
🚩 WTF has ever seen a 700mb PDF file? 🙄
🚩 Overly-large files can't get scanned by cloud anti-virus but CAN be scanned by local AV programs.

I'd like to think that even non-tech-savvy people would notice _at least one_ of the red-flags, but alas, I know better. 🤦

How did the dropper put files under the Windows directory without elevation? 🤨 This is partly on Microsoft, a fresh Windows install should never have new accounts running with admin privileges, they should always default to user-accounts. Duh. 😒

I am probably one of the few people who has worked with legitimate pdfs that large. A high-resolution full-color 700 page scan of sheet music I’ve seen came out to 1.3 GB!


how inconsiderate of these scammers not to include a Linux version 2:25


it looks like the og youtube emails this it's super obvious its a scam


Windows 1 + Windows 2 + Windows 3.0 + Windows 95 + Windows 98 + Windows 2000 + Windows ME + Windows XP + Windows longhorn + Windows Vista + Windows 7 + Windows 8 + Windows 8.1 + Windows 10 + Windows 10X + Windows 11

Try It.....

Windows 10X and Windows XP and down is going to be extremely hard.


yo enderman can you make a tutorial how to use vmware and how to install it? (i dont trust others, im also subscribed and i trust you and also if you already made one then im sorry for wasting your time and also link the video below this comment)


what if you run the windows installer while windows is installed


What was that video? Limbo free download????

it seems like a lot of youtubers have been getting hacked recently

@@kapix4023 but he made a video on a common youtube hack, we're in its comment section


can you make another video of it and reverse it? what was the inside that sussy file?


Yeah the video is AI generated for sure, Sundar doesn't speak like that


The voice of Sundar was generated thru AI lol<br>Most likely voice generative one, but there're plenty out there.

The voice of Sundar was generated thru AI lol
Most likely voice generative one, but there're plenty out there.


I swear his voice changed like 2 times in the scam video


hello! im really trying to find a good virtual machine. do you have a link to download one?

@@dark-mode. whatever allows you to run viruses and shit without it harming your actual computer


I heard some of these things are full of zero-padding, so you might want to grab a hex editor.


Okay This Looks Like A Real YouTube Email

@Coccocoa Helper I Used To Type Like This When I Was Younger Lmao


I never gotten this email at all! it might have been booted to my spam folder


if you are a scammer u cant try to scam enderman or he will roast u


The video that scams people that yt channel wasn't have the small check (verify icon)


Everything in the message is a red flag, good lord! Hell, even the deep fake's a dead giveaway!


Btw how those scammers got ur email? That's strange<br>🤔🤔

Btw how those scammers got ur email? That's strange
🤔🤔


At least Kaspersky and f-secure detect it! (I use Kaspersky).

@@hunterzone4846 I agree, enderman should use it. Kaspersky's system watcher and intrusion prevention are very OP

having the knowledge on how to catch scams and not running random executables from the internet is always safer than relying on antimalware

@@Proferk That is true, an antivirus should always be your second line of defense.


thats a nice way of getting people to notice that youtube is coming for your soul (not like you already sold it to youtube)


wait a min... ENDERMAN IS USING EDGE. wha-? doesn't enderman HATE edge?!


Did anyone realise that he is using microsoft edge?!


6:49 hmm "Youtube Team" is quite unpopular with only 719 subs..hmmm...hmmmmmmmmmmmmmm


enderman. i had last work for discord server. Bye. Thank You


This is the first time I've heard your voiceover

actually he been doing this like last year bro


Its just used an Ai that they maded a video of sunder pichai talk 😂


YouTube seemed to stop giving a damn about security and only cared about screwing content creators.


Oh my god that deepfake video is so bad 😂


It's actually the private video sharing notification, the content of mail is just full of that private video description

@@masdisini ye but how they attach that file with ?

@@HaRsH-GoR The scammer created a channel called YouTube Team and uploaded a deepfake AI video with the text of the email in the video description. Then they use the share function from YouTube to send it to their possible victims. That's why the sender looks legit because it comes from YouTube itself. The email contains the text of the video description and the layout YouTube uses is the same layout they use for official emails. Gmail automatically adds Drive links as a "pseudo attachment". It just opens the Drive link in your browser for you to download the attachment.


The emailed link:
&confirm=no_antivirus

🤔🤔🤔


omg so that's what is happening about .scr files.
I got caught on this once in playing Minecraft with Skype times, like, in 2012? The "screensaver" was sent via Skype chat from one of my internet friends' account, and it looked like a picture and I wanted to open and see it. The first thing I did after realizing was turning off not the PC, but the router, so that the virus didn't spread itself further. After clearing things I turned it back on.
After that I lost my belief in antiviruses, lol


#endermanch on the top!
I mean you didn't do something wrong
But now , Is YouTube trying to scam you? / like linus got hacked but he still posting?


12:46 thats .NET framework (it is just launching that because that scr was a .NET app)


Man can you destroy Windows 10 S Mode with virusses ???

Its the same result if you did it on any other 10 type.


May be an unpopular opinion, but I do prefer the videos with talking instead of text.


I Love your YouTube Channel and Hope IT will be resolved but If Not i Hope you will continue in odessy......


Thank you endermanch i knew it was a scam i am only saying thank you cause my brother destoryed my xp old pc because he really hated your videos and he bought me a new gaming setup to teach me a lesson i shoyld never watch your channel again

@@dark-mode. yeah bro, what kind of substances was his brother on💀💀


What you could have additionally shown is how the file looks in hex editor, more specifically how long is the longest stream of hexadecimal zeroes. The working code of this piece of malware is megabytes at most, and cutting out these excess bytes lets the executable get tested on virustotal to show what exactly is hidden inside the .scr file.


Когда русские субтитры? :(<br>When rus sub? :(

Когда русские субтитры? :(
When rus sub? :(


This looks like program, who hacked Linus Tech Tips


It’s sad, he can’t upload for two weeks☹


Jesus christ they're starting to use the ai voices and faces now

That is VERY scary and concerning


Bro can you make a video on hacking windows 8.1 metro apps to run in a window please in the memory of windows 8.1 please please i would appreciate that


I have 2 of 3 the copyright strike (I created this channel for get banned)


Nah ill wipe the drive and load an image backup


noooo your the best youtuber in the world


This is scam is nasty but kinda mediocre in some aspects lmao


What if windows 8 and windows 11 are combined what will happen 💀

You mean dualbooted? Well nothing wrong will happen it's just that you'll need 2 seperate drives for that and install win11 to one and win8 to the other and boom you have dualboot!

@@SkyKrye He means a hybrid. Ethier way, everyone knows its just gonna be buggy.

@@dark-mode. by hybrid you mean merging drives containing both the OSes? idk how that would work but itd be pretty interesting

@@dark-mode. oh well that's something I've never thought about before, it would definitely be ultra buggy


It's obvious it's fake because the official YouTube Team channel would have a lot more subscribers


IF YOUTUBE TERMINATE THIS CHANNEL LIKING TERMINATED AIDHYSHI HE WILL BACK GETS HATED


6:15 Why do you need to censor the results 😰

@@DaxyGamer Its quick links, I use edge.


Many of these viruses escape VMs, so you should change your password to be safe, unless you were using your Arch PC.

he used his anti vm vm so he should be safe


6:07 He isn't pronounced this way. He is pronounced as "Suundar Pechaae" (spelt as: Sundar Pichai) . Lol he would never pronounce himself this way 🤣🤣🤣🤣


Bro lol down at the video says: CEO google and "alphabet"


This is not new its happened before. While the way they trick you is new, the malware itself isent


i got a glock in my rari<br>17 shots no 38


I know this scam in other version (not youtube & malware packed in rat)


is jokes allowed in the comments section, I'm asking just to try to find out weather jokes are civil or not.


This is why you never use anything video related as proof of anything anymore. unless the video is proven to be from an indivual thats a reliable source, (even then they can still be doctured). You should always ask someone to analyze the video if it has been tampered with in any way. For example the "sundar" video sounded very robotic like if you ever used an ai imitating a famous persons voice itd sound exactly like that vid.


#saveendermanch i watch him 4 years, and if they delete him, i will make protest to google.. i will stay up, to safe him..


Am I the only one who noticed that his pronounciation was really good compared to his real-life one? lol


ayo bro please make a video were you install windows on btrfs


Enderman. My dad forces me to use norton... If he dosen't see norton on my pc. He installs it right away. Is malware bytes better then norton (i think it is better). And how I can convice my dad to stop paying for this shit. help


I love you and all of you're videos ❤. I leant so much, love you and I am so sad😢
                        Good luck🍀,
          I will miss you❤
      And
We will miss you ❤

 Sent from mail for Windows 11
                           Rip Enderman

 We will miss you❤😢


Wait is this Redline Stealer If Yes Sooo.... i got it in my f-ing computer and thank Norton That Save'd me from that shit if no then no.


Bro lol down at the vidio says: CEO google and "alphabet"


Я тоже из Калуги)

Я тоже из Калуги)


They can't even copy youtube email to make it look modern


I can't be the only one watching the deepfake video thinking "man his mouth is not attached to the rest of his head"


DUDE maybe they asking for your password and email just to hack you


I hate scam is bad i dont want to hacked my channel


The fact you used Edge. I’m disappointed.


Тут есть русские?

Тут есть русские?


@@daneo12 Huh, did not know that, thank you for informing me!


Привет ты же помнишь свое-го друга? Daniel Myslivets


first thing i saw on that youtube vid, deepfake, it just looks so fake


Hi You can do a video installing "dx9ware cracked" pls


Введите комментарий

Введите комментарий


Oo pretty smart of you to change the title and add a comment since you cant post


Might be better to talk about the problem in the comments instead, no one goes to the description


is this the same virus that got linus tech tips?

Probably, since the malware that got them was also disguised as a PDF

Possibly, but the LTT one was a fake sponsor agreement.


я тоже русский

я тоже русский


DO NOT UPLOAD AGAIN FOR 90 DAYS. You can possibly be safe from having your channel deleted.

too late, youtube will find the oldest video and the stupidest reason to remove and strike his chanel


is it just me who thinks this looks so fake and couldn't fall for it, because:
1) the video is low-quality and lacks grammar and would have definitely been done better by the youtube team.. who literally own youtube lol
2) youtube channel with 700 subscribers, sus
3) google drive link, which also has "no-antivirus" in it's link, sus
4) the mail looks strange in some way idk
5) the file is very big, sus


you can scan it if you compress it to zip and then upload it 13:36


Did you read his community guidelines, it says no spamming or self promoting aka first


I love your russian accent at times lmao


video idea: makeing the windows 7 installer a working system


This actually is from the real youtube. These people are just making the video private then sharing it with other big youtubers. The text just has the description from the video.

Ah yes... the real YouTube using a 700 subscriber account with the title "YouTube Team" using a deep faked video. This is not from "the real YouTube"

@@GavAttackO I'm saying the message is from the real youtube. thats a real youtube email. you get this email when someone shares a private video with you.


@@BecksAngelic No I didn't, thanks for the comment (enven if it's 1 month later lol)


@@BecksAngelic that aint spamming or self promoting, its just a message


its kinda sus ... 100k views for 1 month the video is up ... WITH 5k likes .... AND 300k subs .... sus


https://www.youtube.com/watch?v=Ebcll7nG8YI it's private now lol


How to stop getting your channel terminated.
                      1. delete videos that ambush people.
                      2. unsubscribe hackers that ambush you.
                      3. remove posts that ambush people.
                      4. do not make videos scammers can watch or else you will be scammed.


sad😔 he can't upload videos 2 months https://www.youtube.com/watch?v=AZfNtTLnFtk


Microsoft Doesn't Even Give A Crap About Quote Unquote "Pirating" Windows 95 Or Any Other Versions Of Windows WTF Its Open Source!


Fuck youtube. What is wrong with you. We love this guy. FOR FUCKS SAKE DONT BAN THIS GUY. DO NOT BAN THIS GUY. WE WATCH HIS CONTENT, HE HAS DONE NOTHING FUCKING WRONG.


i actually learned a lot from his videos. he didnt deserve any of this bs. fuck youtube


I got a message like this Hello yasin

Next steps

As a result of the review, we can:

Notice number: 45208082-677d-4b83-9c2c-15a7b1bb9528.

Your security on YouTube

We want you to feel safe while using YouTube. If you don't want to see certain content, you can block comments or users. Review resources for policies and tools to keep you safe on YouTube.

Thanks,
YouTube Team
Bu kaynak metin hakkında daha fazla bilgiEk çeviri bilgileri için kaynak metin gerekli
Geri bildirim gönder
Yan paneller


pdf files cannot weigh 600 megabytes. Definitely a virus.


First of all find the idiot that did It , and report this YouTube video that YouTube should have already taken down


it's not only the bots anymore, now it's the deep fake people too.

grate job YouTube.

Deep fake people are probably unconscious twits


Have you seen the new ransomware they're using? or STOP/DJVU


I dare you to make a NoEscape.exe Clone or review Clones of the virus


First red flag: Download something. It's almost 100% that YouTube or any other company won't ask You to download anything.

Second red flag: Language. I would really be alarmed by that.

Third red flag: YouTube wouldn't send a Google Drive link. it would be a link directly from YouTube domain. Yes, YouTube has been bought by Google. But it doesn't matter. They wouldn't send a link on Google Drive.

The two former flags could be ignored, because people don't read that. I wouldn't.

Also fourth flag: 7 days? No, it doesn't like that. You get specific date and description that "the new rules would be coming into effect from [insert date here]. Actually in most cases not removing Your account means You accept the rules. And I think they have to notify You 14 days or a month before it will come into effect. Though, people may not know this. Although if only big channels have been hacked, then I can't understand why Linus don't know this.

It's as You say. No company would ask you to download files. That's a big red flag already. And that's something that is often discussed too. This is as obvious as "[Company] won't ask for Your password". That's the very same thing.

First red flag: Download something. It's almost 100% that YouTube or any other company *won't* ask You to download anything.

Second red flag: Language. I would really be alarmed by that.

Third red flag: YouTube *wouldn't* send a Google Drive link. it would be a link directly from YouTube domain. Yes, YouTube has been bought by Google. But it doesn't matter. They wouldn't send a link on Google Drive.

The two former flags could be ignored, because people don't read that. I wouldn't.

Also fourth flag: 7 days? No, it doesn't like that. You get specific date and description that "the new rules would be coming into effect from [insert date here]. Actually in most cases not removing Your account means You accept the rules. And I think they have to notify You 14 days or a month before it will come into effect. Though, people may not know this. Although if only big channels have been hacked, then I can't understand why Linus don't know this.

It's as You say. No company would ask you to download files. That's a big red flag already. And that's something that is often discussed too. This is as obvious as "[Company] won't ask for Your password". That's the very same thing.


I also received similar .scr file to my email last week.
basically the hacker pretended to be my client offering a freelance job,
they send me an attachment detail etc etc.
at first i didn't feel sus at all because it came from ArtStation DM.

but I usually never extract .ZIP file, so I just check the content, and inside it,
it has .jpg file and .scr file that weights around 1GB with extremely high compression ratio.
at that point I knew this is a scam lmao.


Life :D

you get born, you see the new world, you see your father and your mother
you say the first words
you chose to be a doctor
you graduate and your parents are proud of you! you did it!

unfortunately, you ruined your life
"MONEY MONEY MONEY"
you scam people out of their banks and accounts
you get jailed, hated and doxxed on internet. all just for little money.

Life :D

you get born, you see the new world, you see your father and your mother
you say the first words
you chose to be a doctor
you graduate and your parents are proud of you! you did it!

*unfortunately, you ruined your life*
*"MONEY MONEY MONEY"*
*you scam people out of their banks and accounts*
*you get jailed, hated and doxxed on internet. all just for little money.*


I got the same email and made a video the other day. https://youtu.be/5SQ4pY5wCQM


"Scanned by gmail" 😬Google is definitely not scanning password protected zip files so they should definitely warn the user about it and not say they have!


Look, I'm no security expert and I'm not the brightest bulb on the christmas tree, but that really has got phishing scam written all over it. Apart from everything else you've covered, just a badly-worded mildly threatening email with a deadline and a link is enough to have me clicking on the View Message Source button to look for the originating email and/or ip address. The link itself is to a Google drive, another red flag. A 700MB download for a single document is also a no-no. At that point I'd be googling "changes in Youtube rules and policies". It has to be said that's a very amateurish scam from start to finish. I'd have a hard time finding sympathy for anyone who fell for it.


One of the biggest channels on YouTube got hacked with this method which is the 3rd biggest channel in YouTube which is called SET India, they do really need to improve security as their account turned into a Tesla scam stream account it was fixed a few hours later.


Sundar Pichai - Indian. Gosh, I hate Indian Foreigner-Scammers!


This is a redline stealer variant. It steals the session keys that let you log into websites without entering your username/email and password. There is a video about this made by thiojoe.


This is such an OBVIOUS AI deep fake. Just look at AI asmongold or AI XQC show. You can see that this is just and deep fake.


7:50 It seems like you haven't grasped what actually happened.
What the scammers did is that they created an account called YT Team, uploaded a private video, and used YT's own feature of sharing private videos with pther Google accounts. Note that it's labeled "Private" by YT, not "Unlisted". This means that only specific Google accounts that the scammer shared the video to can view the video. As a result, the sender of the email is actually YT. The "design" of the email is not controlled by the scammers, because it's literally YT's own feature of sharing private videos to other people. Try it yourself: click "share" on one of your private videos and choose another Google account, and see what the email looks like.
You said the scammers failed by choosing the wrong email address to send this email to. But the reality is, this is the only email address that they could target, because it's the email address associated with your channel. They only chose your channel when sharing the private video; they don't even need to know what your email address is.
You also made the mistake of assuming that it's a lookalike when it's actually a deepfake. It's easy to spot: the voice is weirdly flat, and the bottom edge of his beard disappears into thin air when the mouth is open big. But you did say that you noticed while editing so I guess you noticed these too.
You knew it's a scam from the start, and thus assumed that everything is fake. Just like people that fell for the scam assumed it's real from the start and thus assumed that everything is real. This assumption is what made people prone to fall for scams.

Edit: And you also assumed that Sundar Pichai is not actually the CEO of Google when he actually is. That's another of your wrong assumptions. Not to mention, how can you not know that already?


I’m pretty sure shady files use a password that they give to you simply to avoid detection by AV as it is harder to detect an encrypted file.


VirusTotal will not flag it as a Zip-Bomb if you go into HxD and remove all the "Null_Byte" Padding in the File, because the "Archive" Type makes it appear as a Zip-Bomb even if the real threat is a Stealer... so next time, just use HxD to remove all 00-Bytes at the end of the file (until you only have one single line of 00-Bytes left, then save it and upload it to VT, i promise you, the result will be much different


It would be nicer if you would had used a program like "Farbar Recovery Scan Tool" to create log files before and after running the malware - could have been interesting.🙂