Someone showed me a polished ad for some crypto thing, but when I looked at the code the ad wanted you to run it had a bunch of obfuscation that redirected everything you owned to a specific wallet address. I checked six weeks later and YouTube was still running the ad. The wallet had something on the order of $20m added to it in that time.