Phishing-as-a-Service Kit Uses Fake YouTube Copyright Notices to Steal Creator Logins
Summary
Malwarebytes analyzed a phishing-as-a-service kit targeting YouTube creators with personalized fake copyright notices and a Browser-in-the-Browser Google login overlay. It rotates domains, tracks affiliates, and exempts channels over 3 million subscribers.
Key points
- The phishing site uses creators’ channel details and recent video information to generate personalized fake copyright complaints.
- A fake Chrome sign-in window imitates Google’s login page; the article says entered keystrokes are sent to the attackers.
- Observed traffic showed the site fetching an active phishing domain in real time, allowing operators to rotate infrastructure.
- The campaign used dmca-notification[.]info and the credential-harvesting domain blacklivesmattergood4[.]com; three other observed domains returned 502 errors during capture.
- Source-code analysis found affiliate tracking and a flag named suppressTelegramVisit, suggesting coordinated distribution through a shared phishing platform.
- The kit skips its phishing flow for channels with more than 3 million subscribers, which the researchers describe as an evasion tactic.
- The article recommends checking copyright status directly in YouTube Studio, verifying the real browser address bar, and changing passwords and revoking sessions if credentials were entered.
Article Details
- Attack Vectors
- A fake YouTube copyright-strike page targets creators and uses their channel handles to personalize phishing links.
- The phishing page retrieves real channel details, including avatars, subscriber counts, and recent uploads, to make fabricated copyright complaints more convincing.
- A fake Browser-in-the-Browser Google sign-in window captures credentials entered by victims and sends them to the attacker.
- The phishing kit fetches an active phishing domain from its backend without caching it, allowing the operators to rotate domains.
- Affiliate IDs track which operator referred each victim and how far the victim progressed through the phishing flow.
- Lookalike Cyrillic characters in brand names are used in source code to evade automated security scanners.
- The kit skips channels with more than three million subscribers, which the article describes as an evasion tactic.
- Defensive Notes
- Check copyright status directly in YouTube Studio or through another trusted channel, not through a link in a message.
- Verify the real browser address bar before entering credentials; the article notes that a Browser-in-the-Browser window is only part of the webpage.
- Be wary of urgency and do not sign in through links promising to resolve a copyright claim.
- If credentials were entered, change the Google password, revoke active sessions, and check the YouTube channel for unauthorized changes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | blacklivesmattergood4[.]com | Credential-harvesting phishing domain returned by the campaign backend and loaded in the fake sign-in overlay; active at the time of capture. |
| DOMAIN | dmca-notification[.]info | Primary phishing site impersonating YouTube copyright notices and directing creators toward credential theft. |
| DOMAIN | dopozj[.]net | Associated campaign infrastructure contacted during traffic capture; it returned a 502 error and may have been backup infrastructure or a credential relay. |
| DOMAIN | ec40pr[.]net | Associated campaign infrastructure contacted during traffic capture; it returned a 502 error and may have been backup infrastructure or a credential relay. |
| DOMAIN | xddlov[.]net | Associated campaign infrastructure contacted during traffic capture; it returned a 502 error and may have been backup infrastructure or a credential relay. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe fake Google sign-in page captures credentials entered into its Browser-in-the-Browser overlay and sends them to the attacker.T1566.002 · Spearphishing LinkThe campaign uses phishing links personalized with target YouTube channel handles to direct creators to fake copyright and sign-in pages.T1656 · ImpersonationThe phishing page impersonates YouTube copyright notices and presents a fake Google sign-in window to deceive targeted creators.
Products
Googlepersonalized fake copyright strike page that pulls real channel data and uses a Browser-in-the-Browser Google sign-in overlay to harvest credentials.YouTubeAttackers run a phishing-as-a-service campaign targeting YouTube creators with a highly personalized fake copyright strike page that pulls real channel data and uses a Browser-in-the-Browser Google sign-in overlay to