Fake Amazon Music Deal Phishing Campaign Targets YouTube Creators for Google Credentials
A sophisticated phishing operation impersonates a legitimate Amazon Music and YouTube partnership to steal YouTube creators' Google account credentials.
Cybercriminals are employing a deceptive phishing campaign that mimics a legitimate partnership between Amazon Music and YouTube, aiming to pilfer the Google account credentials of YouTube creators. The fraudulent "Amazon Artists Music - Creator Portal" website is designed to appear highly convincing, even incorporating real YouTube channel statistics to lure unsuspecting victims.
The campaign capitalizes on a recent announcement where Amazon joined YouTube's Shopping Affiliate Program, allowing creators to earn commissions by tagging Amazon products in their videos. However, this new phishing scheme presents an "invite-only" advertising deal with Amazon Music, a program that does not actually exist. The fake portal, hosted on a domain like amazonyt[.]com, uses the name "Amazon Artists Music — Creator Portal" to evoke familiarity with Amazon's legitimate services.
To entice creators, the site features an "earnings calculator" that generates seemingly personalized payout estimates based on user-inputted channel data. This calculator, while functional, serves as a lure to keep victims engaged before the attackers request sensitive login information. The phishing site is also available in nine languages, indicating a broad, international targeting strategy aimed at creators across various regions.
Once a creator provides their YouTube channel link, the fake portal displays their actual channel statistics, including subscriber counts, view data, and top-performing uploads. This personalization is achieved by querying YouTube's public API, using multiple API keys to avoid detection. Presenting the victim's own data on an Amazon-branded page lends an air of legitimacy and makes the offer appear tailored specifically to them.
The crucial step in the phishing process involves a "Verify Your Channel" prompt, which presents a familiar "Continue with Google" button. While the site includes genuine Google sign-in code, it is rendered inactive. Clicking this button triggers a full-screen frame that loads content from a secondary domain, youtubechannelverification[.]com. This technique, similar to other observed phishing tactics, allows attackers to control the user interface and capture credentials without altering the browser's address bar, which continues to display the fake Amazon domain.
This method of credential harvesting is particularly effective because it leverages the trust creators place in both Amazon and Google's platforms. By combining elements of a real partnership with a fake opportunity and a convincing, yet deceptive, login mechanism, attackers can successfully trick creators into compromising their accounts.
If creators fall victim to this scam, their Google accounts are at immediate risk, potentially leading to the hijacking of their YouTube channels, unauthorized access to their content, and the misuse of their associated services. The attackers could then exploit these compromised accounts for further malicious activities, such as spreading more phishing links or distributing malware.
Security experts advise creators to be highly skeptical of unsolicited offers, especially those promising exclusive or "invite-only" deals. It is crucial to independently verify any partnership or offer directly through official channels and to always check the browser's address bar for legitimate domain names before entering any login credentials. If a creator has already submitted their information, they should immediately change their Google account password, review account activity for suspicious actions, and revoke any unfamiliar permissions or linked applications.