Fake Amazon Music Sponsorship Lures YouTube Creators Into Google Credential Theft

Summary

A phishing campaign uses personalized YouTube channel data and a fake Amazon Music offer to steal Google passwords and MFA codes through a sign-in form hosted on a second domain.

Key points

A fake invite-only Amazon Music sponsorship site uses creators’ public channel statistics to make offers appear personalized.
The site loads a transparent sign-in frame from youtubechannelverification[.]com while the browser address bar remains on amazonyt[.]com.
The analyzed form sent entered email addresses and passwords to its own server and supported MFA challenges.
A fabricated verification success page unlocks an offer and displays a submission confirmation, potentially delaying victims’ suspicion.
The real Amazon and YouTube Shopping partnership is for commissions on tagged products; creators should verify offers independently and only enter credentials on Google’s genuine sign-in page.
Anyone who entered credentials should change their Google password, review account activity and recovery details, remove unrecognized apps, and check YouTube channel permissions.

Article Details

Attack Vectors: A fake Amazon Music creator-portal site used creators’ public YouTube channel statistics to make an invitation-only sponsorship offer appear personalized.
Clicking a fake “Continue with Google” button loaded a sign-in form from a second domain inside a full-screen frame. The analyzed form sent entered email addresses and passwords to the second-stage site and supported MFA challenges.
After credential submission, a configured success page returned visitors to the first site and displayed an unlocked offer and confirmation, potentially delaying suspicion.
Defensive Notes: Do not enter Google passwords or verification codes into pages reached through sponsorship offers. Verify that sign-in occurs on Google’s genuine sign-in page and check the browser’s actual address bar.
Verify offers independently through contact details obtained from the company’s official website.
If credentials were entered, change the Google password, review account devices and sessions, remove unrecognized third-party apps, check recovery details, and review YouTube Studio and Brand Account permissions.
Treat an account as potentially compromised if an MFA code was entered or a sign-in prompt was approved.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`amazonyt[.]com`	Phishing-lure domain hosting the fake Amazon Music creator portal and post-verification offer.
DOMAIN	`youtubechannelverification[.]com`	Second-stage phishing domain that loaded the credential form and collected submitted Google sign-in details and MFA challenge responses.