I didn't watch the video, but if he was using NH, there's a chance they gave him malware by using a compromised PhoenixMiner. I'm assuming this is the case because actual Phoenix Miner hasn't been updated in over a month. All this stuff from NH seems to be a big screw up by them and not Phoenix. Nothing NH has said is really true except that PhoenixMiner is closed source which has always been true and is true of almost all of the mining software out there, so not exactly a bombshell thing to post and is proof of exactly nothing as far as PhoenixMiner being malware is concerned.
[BrandonCoin][YT] talks about "wierdness" with one of his mining PCs after PhoenixMiner got updated on his PC.