{
 "tag": "youtube",
 "name": "Youtube",
 "group": "Platforms & channels",
 "incidents": [
  {
   "slug": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "title": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "json": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Mac users with Ledger Live, Trezor Suite or desktop/extension wallets",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "macos",
    "infostealer",
    "ledger",
    "trezor",
    "clickfix",
    "google-ads",
    "youtube",
    "moonlock",
    "notnullosx"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-10",
   "closedAt": "2026-04-10",
   "updatedAt": "2026-04-10T12:00:00Z",
   "summary": "Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published."
  },
  {
   "slug": "ai-video-mev-bot-tutorials-drainer-contracts-aug-2025",
   "title": "YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken",
   "url": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025",
   "json": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "SentinelLABS says several tutorial videos appear to be AI-generated from audio and visual tells, though the most successful one (about $902,000 taken) does not appear to be."
   },
   "chains": [
    "ethereum"
   ],
   "method": "social-engineering",
   "product": "Ethereum users following YouTube 'MEV bot' tutorials",
   "tags": [
    "ethereum",
    "social-engineering",
    "mev-bot",
    "fake-trading-bot",
    "youtube",
    "remix",
    "smart-contract-scam",
    "ai-generated-video",
    "sentinelone",
    "ai"
   ],
   "amountUsd": 900000,
   "victims": null,
   "startedAt": "2025-08-05",
   "closedAt": "2025-08-05",
   "updatedAt": "2025-08-05T12:00:00Z",
   "summary": "SentinelLABS reported in August 2025 that scammers use YouTube tutorials to get people to deploy a 'free' Ethereum arbitrage bot contract through Remix, fund it with ETH and press Start. Hidden code sends the ETH to an attacker wallet, and the top attacker address alone received 244.9 ETH (about $902,000). The videos ran on aged channels with manipulated comments, and SentinelLABS says several appear to be AI-generated. Versions of the scam have run since at least early 2024 and were described as ongoing."
  }
 ],
 "changes": [
  {
   "incident": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "incidentTitle": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-10",
   "title": "Moonlock publishes its analysis of notnullOSX, including the module that swaps hardware-wallet apps for trojanized copies.",
   "sourceUrl": "https://moonlock.com/new-mac-stealer-notnullosx",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026"
  },
  {
   "incident": "ai-video-mev-bot-tutorials-drainer-contracts-aug-2025",
   "incidentTitle": "YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-08-05",
   "title": "SentinelLABS' report (updated 5 August 2025) listed three attacker addresses and more than $900,000 taken.",
   "sourceUrl": "https://www.sentinelone.com/labs/smart-contract-scams-ethereum-drainers-pose-as-trading-bots-to-steal-crypto/",
   "url": "https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025"
  }
 ]
}