Attackers are using YouTube redirect links, whitelisted by various security defense mechanisms, to evade detection.
Source: Threadpost