Phishing sites use real YouTube stats to trick creators into handing over Google login credentials for fake deals.
Key points
- Fake portals steal Google sign-in details by promising Amazon Music advertising deals.
- The sites display accurate channel statistics to build false credibility with victims.
- Users should verify offers through official YouTube Studio notifications only.
Malwarebytes Labs reported a phishing campaign targeting YouTube creators with fake Amazon Music partnership offers. The scheme uses convincing interfaces and real channel data to steal Google account credentials.
What happened
On August 27, YouTube announced that Amazon joined its Shopping Affiliate Program, allowing eligible creators to tag products and earn commissions. Weeks later, Malwarebytes Labs identified a wave of fraudulent sites offering an invite-only advertising deal with Amazon Music. These sites, hosted at amazonyt[.]com, mimic the real Amazon Music for Artists service but operate as a “creator portal.”
The fraudulent site asks visitors to paste their YouTube channel link. It then queries YouTube’s public API to display real subscriber counts, view totals, and recent uploads. This accurate data makes the offer appear tailored and legitimate. The site includes an earnings calculator that performs real math on user inputs, showing estimated payouts for various campaign packages.
Despite the convincing interface, the offer remains locked until the user “verifies” their channel. This verification step is a phishing trap designed to capture Google sign-in details. The site is available in nine languages, including English, Spanish, Russian, and Hindi, indicating a global target audience.
Why it matters
Phishing attacks often rely on social engineering rather than technical exploits. By displaying accurate public data, attackers create a false sense of legitimacy. Users tend to trust interfaces that reflect their personal information accurately. This technique bypasses skepticism because the initial interaction appears customized and professional.
The fix
- Change your Google password immediately if you entered details.
- Check account activity for unauthorized access or changes.
- Review channel permissions to remove any third-party app access.
- Verify future offers through official YouTube Studio notifications.
Why it matters
Security teams usually emphasize that public data can be used to build trust. Attackers leverage this by scraping visible metrics to make scams appear personalized. Users should check whether a request for credentials comes from a known, verified domain. Legitimate platforms rarely ask for login details through third-party portals or unsolicited emails.
Background: Social engineering
Small organizations face unique social engineering risks due to limited staff and budget constraints. You can mitigate these threats by implementing strict verification protocols, training employees on manipulation tactics, and auditing third-party access rights with your IT provider.
Read the full guide: Social Engineering Risks and Protection for Small Businesses
What to do and how to stay safe: Malwarebytes
- Verify any partnership offer by checking for a notification inside YouTube Studio.
- Inspect the browser address bar carefully before entering any credentials.
- Enable two-factor authentication on your Google account to add a layer of security.
- Monitor your account activity regularly for any unfamiliar sign-ins or permission changes.
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the Amazon Music creator portal real?
No, the portal at amazonyt[.]com is a phishing site designed to steal Google login details.
How do these sites get my channel statistics?
They query YouTube’s public API directly from your browser using multiple API keys.
What was the real Amazon and YouTube partnership?
It allows eligible creators to tag Amazon products in videos and earn commissions on sales.
