Malwarebytes Labs Exposes Fake Amazon Music Portal Phishing YouTube Creators
A fraudulent site mimicking an Amazon Music deal uses real channel data to trick creators into surrendering Google login credentials.
Key points
- The phishing site at amazonyt.com displays accurate subscriber counts and view statistics to build trust with victims.
- Attackers use twenty Google API keys to pull public data, making the fake portal appear personalized and legitimate.
- The scheme targets creators globally, offering the fraudulent interface in nine languages including English, Spanish, and Hindi.
Malwarebytes Labs researchers identified a phishing campaign that tricks YouTube creators into surrendering Google login credentials by posing as an exclusive Amazon Music advertising partnership. The threat actors operate a convincing fake portal that displays the victim’s actual channel statistics to lure them into a verification trap.
The fraudulent website, hosted at amazonyt.com, presents itself as the “Amazon Artists Music — Creator Portal.” It promises invitation-only advertising collaborations with Amazon and Amazon Music, urging visitors to use links from alleged outreach emails. The site includes an earnings calculator that estimates payouts based on user inputs, creating a false sense of legitimacy before requesting sensitive sign-in details.
Context and Background
This scam emerged weeks after YouTube announced on August 27 that Amazon had joined its Shopping Affiliate Program. The legitimate partnership allows eligible creators to tag Amazon products in videos and earn commissions, a process verified through YouTube Studio and official Amazon sites. The fake portal exploits this news by inventing a separate, invite-only music ad campaign that does not exist.
Unlike the real program, which requires account linking within official platforms, this phishing site operates on a third-party domain. It mimics the branding of Amazon Music for Artists to lower user suspicion. The criminal operators designed the interface to look like a professional creator dashboard, complete with tailored offers and complex payout structures that do not correspond to any real commercial agreement.
Who Is Affected
The campaign targets content creators across multiple regions, with the phishing site available in nine languages: English, Spanish, Indonesian, Portuguese, Russian, Urdu, Arabic, Hindi, and Thai. This multilingual approach indicates a broad international scope for the attack.
To enhance credibility, the site queries YouTube’s public API directly from the victim’s browser using twenty embedded Google API keys. If one key hits usage limits, the code automatically switches to another. This technical sophistication allows the portal to display real subscriber counts, recent uploads, and view totals, making the offer appear as though a human recruiter has already assessed the channel.
What should you do?
Malwarebytes Labs advises creators to verify any such offers independently and check the browser address bar before entering any credentials. If you have already entered your Google password or verification codes on this site, you must secure your account immediately. Change your password, review recent account activity, and audit channel permissions to remove any unauthorized access granted during the phishing attempt.
What to do and how to stay safe: Malwarebytes Labs
- Verify the URL of any portal requesting login details, ensuring it belongs to an official domain like google.com or amazon.com rather than a lookalike address.
- Check your YouTube Studio notifications for official partnership confirmations, as legitimate programs communicate through these verified channels.
- Review connected apps and third-party permissions in your Google Account settings to revoke access for any unknown or suspicious services.
- Monitor your account activity logs for unrecognized logins or changes to channel settings, and enable two-step verification if not already active.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a real Amazon Music advertising deal for YouTube creators?
No, the fake portal invents an invite-only ad campaign; the real partnership involves product tagging and commissions via the Shopping Affiliate Program.
How does the fake site know my channel statistics?
It uses YouTube’s public API and multiple Google API keys to pull publicly available data directly from your browser.
What should I do if I already logged in on the fake site?
Change your Google password immediately, check account activity, and review channel permissions to remove any unauthorized access.
