Problem
Fake sponsorship PDFs disguised as executable screen savers or installers can steal browser session cookies from a creator workstation.
Solution
Root Cause / Diagnostic:
Infostealer malware families (such as RedLine, Vidar, or Lumma Stealer) are delivered inside double-extension files (e.g., `Sponsorship_Agreement.pdf.exe` or `.scr`) disguised with Adobe Acrobat icons. When executed, the malware extracts encrypted browser session tokens, cookies, and saved passwords from Google Chrome/Edge local app data and exfiltrates them via Telegram/C2 servers, bypassing two-factor authentication (2FA).
Actionable Fix:
1. Windows Explorer Extension Unhiding & AppLocker: Enable "File name extensions" in Windows Explorer to reveal hidden executable extensions (`.exe`, `.scr`, `.bat`), and enforce AppLocker/Software Restriction Policies blocking unapproved executables from running in `%temp%` and `Downloads`.
2. Dedicated Sponsorship Sandbox: Open all sponsor attachments and contracts on a physically isolated Chromebook, iPad, or virtual machine (Windows Sandbox) that has zero access to YouTube channel credentials.
3. Anti-Malware & Process Audit: Deploy endpoint detection and response (EDR) tooling (e.g., Malwarebytes or CrowdStrike) and verify automated quarantine of malicious payload drops.
Pro Tip:
Attackers send fake sponsor contracts ending in '.pdf.exe' that steal your active YouTube login cookies in two seconds; always unhide file extensions in Windows and only open sponsor PDFs inside a sandbox or Chromebook.
Infostealer malware families (such as RedLine, Vidar, or Lumma Stealer) are delivered inside double-extension files (e.g., `Sponsorship_Agreement.pdf.exe` or `.scr`) disguised with Adobe Acrobat icons. When executed, the malware extracts encrypted browser session tokens, cookies, and saved passwords from Google Chrome/Edge local app data and exfiltrates them via Telegram/C2 servers, bypassing two-factor authentication (2FA).
Actionable Fix:
1. Windows Explorer Extension Unhiding & AppLocker: Enable "File name extensions" in Windows Explorer to reveal hidden executable extensions (`.exe`, `.scr`, `.bat`), and enforce AppLocker/Software Restriction Policies blocking unapproved executables from running in `%temp%` and `Downloads`.
2. Dedicated Sponsorship Sandbox: Open all sponsor attachments and contracts on a physically isolated Chromebook, iPad, or virtual machine (Windows Sandbox) that has zero access to YouTube channel credentials.
3. Anti-Malware & Process Audit: Deploy endpoint detection and response (EDR) tooling (e.g., Malwarebytes or CrowdStrike) and verify automated quarantine of malicious payload drops.
Pro Tip:
Attackers send fake sponsor contracts ending in '.pdf.exe' that steal your active YouTube login cookies in two seconds; always unhide file extensions in Windows and only open sponsor PDFs inside a sandbox or Chromebook.