Fwiw I had to report one of those "free win11 activated" videos as it was having users download and run a script from a suspicious source and handing full domain admin to a 3rd party.