Phishing Campaign Targets YouTube Creators with Fake Amazon Music Deal

What happened

A wave of websites surfaced that claim to offer YouTube creators an exclusive Amazon Music advertising partnership. The pages display the visitor’s own YouTube statistics—subscriber count, watch hours, and revenue figures—pulled from the YouTube API. After a brief “verification” step, the site promises a personalized commission structure.

Instead of a legitimate partnership, the verification step is a phishing prompt that asks for the creator’s Google account credentials. Once the credentials are entered, the attacker can access the Google account, YouTube channel, and any linked services.

Who is affected

Any YouTube creator who receives an unsolicited invitation to a new Amazon Music deal is at risk. The threat is tailored to channels that are part of the YouTube Partner Program or the YouTube Shopping Affiliate Program, as these are the only groups eligible for real Amazon collaborations.

Because the phishing site displays real channel data, it can deceive even experienced creators who trust the authenticity of the metrics. The attack does not discriminate by channel size; both small and large creators can be targeted.

Impact

Compromise of a Google account grants attackers full control over the associated YouTube channel. This includes the ability to delete videos, alter channel settings, and publish malicious content. The attacker can also access billing information, potentially incurring charges on the creator’s Google Cloud or Google Ads accounts.

Beyond immediate account takeover, credential reuse can lead to lateral movement into other cloud services, email accounts, and corporate networks if the same credentials are used elsewhere.

Exposure

The phishing site uses a domain that mimics official Amazon or YouTube URLs, often with subtle misspellings or additional subdomains. The page’s SSL certificate is valid, which can lull users into trusting the site. The displayed channel statistics are fetched via the YouTube Data API, giving the page a veneer of legitimacy.

Once credentials are harvested, attackers can log into the Google account from any device, bypassing basic security controls. If multi‑factor authentication (MFA) is not enabled, the attacker can immediately gain full access.

What to do

Defenders should adopt a multi‑layered approach to protect creators and their accounts. The following actions are recommended:

• Verify any unsolicited partnership offers by contacting the official Amazon or YouTube support channels directly.
• Check the browser address bar for the exact domain; legitimate Amazon or YouTube URLs use the official domains (amazon.com, youtube.com).
• Require all creators to enable two‑factor authentication on their Google accounts.
• Implement a policy that blocks login attempts from unfamiliar IP addresses or devices, and alert on repeated failed attempts.
• Educate creators to avoid entering credentials on any site that asks for Google sign‑in outside of the official Google sign‑in flow.
• Use a web filtering solution that blocks known phishing domains and alerts on suspicious URL patterns.
• Regularly review account activity logs in Google Admin Console and look for unfamiliar sign‑ins or changes to channel permissions.

What to watch

Attackers may evolve the phishing site to include additional social engineering tactics, such as offering instant payouts or claiming a partnership with a popular music streaming service. They may also use compromised legitimate domains to host the malicious page.

Keep an eye on new phishing campaigns that target content creators, especially those that leverage real API data to appear authentic. Monitoring threat intelligence feeds and subscribing to phishing alert services can help detect emerging threats early.

“The key to stopping credential theft is to make the attacker’s job harder than the victim’s.”