Cybercriminals abused GitHub, YouTube and VirusTotal to push crypto-stealing malware