Fake Amazon Music deal phishes YouTube creators for Google logins
Original title: Fake Amazon Music x YouTube deal lures creators into a Google login trap
A portal at amazonyt[.]com shows public channel stats, then a overlaid page collects Google passwords and MFA codes.
Malwarebytes describes sites pitching YouTube creators an invite-only Amazon Music ad deal after YouTube said on August 27 that Amazon joined its Shopping Affiliate Program. amazonyt[.]com displays a creator’s public channel data, then a “Continue with Google” control opens a frame from youtubechannelverification[.]com while the address bar still shows amazonyt[.]com. Code analyzed sent the entered email and password to the operators and supported MFA challenges. The site is offered in nine languages.
Unconfirmed: Malwarebytes analyzed the phishing flow; it does not say how many creators submitted credentials or lost accounts.
- The real program links accounts on Amazon’s site and confirms tagging in YouTube Studio.
- The fake portal is not Amazon Music for Artists and includes a payout calculator.
- The site queries YouTube’s public API in the browser using 20 Google API keys.
- A success URL can mark the channel verified and unlock the offer.
- Languages include English, Spanish, Indonesian, Portuguese, Russian, Urdu, Arabic, Hindi, and Thai.
Impact: Stolen Google passwords and MFA codes risking account takeover
- 1.Do not enter a Google password or verification code on these offer sites.
- 2.If you already did, change the Google password and review activity and channel permissions.
- 3.Confirm Amazon–YouTube offers only on Amazon’s site and in YouTube Studio.
- Products
- YouTubeAmazon Music
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | amazonyt.com | An invite-only deal that doesn’t exist The site, hosted at amazonyt[.]com, calls itself the “Amazon Artists Music — Creator Portal. |
| domain | youtubechannelverification.com | of the page. The frame loads content from a second domain, youtubechannelverification[.]com . Its background is almost completely transparent, so wha |
From the original article
8 min read at malwarebytes.com
A convincing “creator portal” uses your own YouTube videos and viewing figures to steal your Google login.
By @malwarebytes · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.