MALWAREBYTES warns of a phishing campaign targeting YouTube creators under the guise of an invite‑only advertising deal with Amazon Music. The fraudulent site, hosted at amazonyt[.]com, mimics an “Amazon Artists Music — Creator Portal” and promises advertising collaborations, complete with a multi‑tier earnings calculator that uses real channel data to seem credible.
The lure is designed to surface a personalised dashboard showing subscriber counts, recent uploads and other metrics, making creators more likely to trust the offer.
The trap hinges on a fake Google sign‑in step. After the site displays the customised dashboard, creators are prompted to “Verify Your Channel” by clicking a Continue with Google button. In reality, the sign‑in form is loaded from a second domain, youtubechannelverification[.]com, overlaid within a full‑screen frame while the address bar still shows amazonyt[.]com. The second stage collects the entered email address and password, and even supports MFA prompts.
This setup lets criminals capture credentials and verification codes, risking account takeovers and potential channel compromise. The campaign includes multi‑language support across nine languages and uses public YouTube API data to tailor the lure, strengthening its credibility.
If you’ve already entered details, change the Google password via official channels, review devices and sessions, and audit YouTube channel permissions. The indicators of compromise are the two domains noted above: amazonyt[.]com and youtubechannelverification[.]com. Malwarebytes recommends blocking the phishing pages with Browser Guard and verifying offers independently through official sources.