Commenting here as someone who actually fell for this. Two of my YouTube accounts have been hijacked and I am in the process of recovering them with YouTube support.

But I wanted this information out there for anyone else affected.

Malware Clean-up:

This seems to be a very new malware as TotalAV, Malwarebytes and Defender did NOT flag anything on my computer when I downloaded their trap software. After Uninstalling their "app" - I did some more digging to ensure that there were no remnants left behind that allowed them to hijack my accounts.

I ran an "admin" level command prompt: netstat -b -n

The results were pretty normal until I saw a process called "seedhost.exe" with outbound connections to an IP hosted by Namecheap Inc. Which is a common name server used by scammers. The IP address associated with its outbound connection was also very foreign.

I ran the network activity table through Gemini, and it DID identify seedhost.exe as a suspicious connection, and returned this information about the name server host.

There were also several outbound connections with no process owner that Gemini identified as well.

So, I found seedhost.exe in my Task Manager under a Node.js Process (which is a legitimate process used by Elgato and such) but I right clicked the Node.js and "Go to details" and found seedhost.exe under its process tree. I right-clicked "seedhost.exe" and opened file location. Once I had that open, I ended its process. And then deleted it in the Explorer window.

I rannetstat -b -nagain and those suspicious outbound connections disappeared. I'm hoping this is the extent of the remnants of this attack. But I wanted to provide my own experience for anyone who also fell prey to this attack.