In this paper, we investigate the downlink secure beamforming (BF) design problem of cloud radio access networks (C-RANs) relying on multicast fronthaul, where millimeter-wave and microwave carriers are used for the access links and fronthaul links, respectively. The base stations (BSs) jointly serve users through cooperating hybrid analog/digital BF. We first develop an analog BF for cooperating BSs. On this basis, we formulate a secrecy rate maximization (SRM) problem subject both to a realistic limited fronthaul capacity and to the total BS transmit power constraint. Due to the intractability of the non-convex problem formulated, advanced convex approximated techniques, constrained concave convex procedures and semi-definite programming (SDP) relaxation are applied to transform it into a convex one. Subsequently, an iterative algorithm of jointly optimizing multicast BF, cooperative digital BF and the artificial noise (AN) covariance is proposed. Next, we construct the solution of the original problem by exploiting both the primal and the dual optimal solution of the SDP-relaxed problem. Furthermore, a per-BS transmit power constraint is considered, necessitating the reformulation of the SRM problem, which can be solved by an efficient iterative algorithm. We then eliminate the idealized simplifying assumption of having perfect channel state information (CSI) for the eavesdropper links and invoke realistic imperfect CSI. Furthermore, a worst-case SRM problem is investigated. Finally, by combining the so-called $\mathcal{S}$-Procedure and convex approximated techniques, we design an efficient iterative algorithm to solve it. Simulation results are presented to evaluate the secrecy rate and demonstrate the effectiveness of the proposed algorithms.