Reportedly Gray Hughes had his YouTube/Google account taken over after a phishing attack. The attacker changed his recovery info and locked him out. If you live on YouTube, lock your Google account down. Regular 2FA is not enough. 2FA codes (Authenticator, texts, Google prompts) can still get phished. You type the code on a fake Google page and you’re done. What actually stops that is Google’s Advanced Protection Program plus a physical security key. Two Yubico Security Key C NFC keys. One on the keychain, one at the desk. Phone passkeys as a backup so you’re not locked out if you lose one. Then turn on Advanced Protection. Google Titan keys work too. In plain English: a fake login page can steal a password and a 6-digit code. It cannot fake the little USB key. The key only talks to the real Google. Doesn’t make you unhackable If you download a file from a fake sponsor email, malware can still steal your logged-in session and change your password from your own machine. Scan files before you run them. Don’t open attachments from cold emails.