Fake Amazon Music x YouTube deal lures creators into a Google login trap

In this article Fake Amazon Music deals use real YouTube stats as bait. Fake verification steals Google sign-in details, risking account takeovers. Make sure to verify offers independently and check the browser address before signing in. Already entered your details? Change your password and check account activity and channel permissions. On August 27, YouTube announced that Amazon had joined its Shopping Affiliate Program. Eligible creators can now tag Amazon products in their videos and earn a commission on sales. Weeks later, we found a wave of sites offering YouTube creators what looks like another Amazon opportunity: an invite-only advertising deal with Amazon Music. The site shows creators their own channel stats, then asks them to “verify” their channel with Google before it reveals a personalized offer. That verification step is a phishing attempt designed to steal Google sign-in details, putting the creator’s account and YouTube channel at risk. If you receive one of these offers, don’t enter your Google password or verification codes. If you already have, secure your Google account immediately using the steps below. What the real Amazon and YouTube partnership looks like The real partnership lets eligible creators in the YouTube Partner Program and YouTube Shopping affiliate program tag Amazon products in their videos, Shorts, and livestreams, and earn a commission when viewers buy. YouTube’s setup guidance also describes linking Amazon and YouTube accounts, with a notification in YouTube Studio once tagging is enabled. The real program does include a step where you connect and verify your channel. But it happens inside an Amazon account you already have, on Amazon’s own site, and YouTube confirms it in YouTube Studio. It doesn’t involve invite-only Amazon Music ad campaigns, payout calculators, or a third-party “creator portal.” An invite-only deal that doesn’t exist The site, hosted at amazonyt[.]com, calls itself the “Amazon Artists Music — Creator Portal.” The name resembles Amazon’s real Amazon Music for Artists service, helping it feel familiar at first glance. It promises “advertising collaborations with Amazon and Amazon Music,” describes the program as invitation-only, and tells visitors to use “the link from your Amazon Music Artists outreach email.” There’s even an earnings calculator. You pick one of four packages (a Shorts package, an integration in a planned video, a dedicated video, or a “full campaign package”), set your average views, add “boosters” like extra Shorts or a livestream mention, and choose how exclusive the deal should be. The page then shows an “estimated payout” and compares it with the “endless back-and-forth and delayed payments” of ordinary brand outreach. The calculator does real math on the numbers you enter. But a working calculator doesn’t make the payout real. The estimates give creators a reason to keep going before the site asks for their sign-in details. The site is available in nine languages: English, Spanish, Indonesian, Portuguese, Russian, Urdu, Arabic, Hindi, and Thai, suggesting the operators are targeting creators across multiple countries. Your own channel, used as bait Next, the site asks for your YouTube channel link. Once you paste it, a dashboard displays your real channel data: subscriber count, total views, recent and top-performing uploads, playlists, topics, and thumbnails. Seeing your own data on an Amazon-branded page makes the offer feel tailored to you. To pull this data, the site queries YouTube’s own public API directly from your browser. The code includes 20 Google API keys and automatically switches to the next one if a key hits its usage limit or is rejected. This data is public, so looking it up isn’t theft in itself. What it buys the criminals is credibility. A site that knows your subscriber count and your latest upload can look as though someone has already assessed your channel for a deal. The offer itself stays locked until you “verify” your channel. The fake “Continue with Google” button To unlock it, you have to “complete the required step: Verify Your Channel .” The page says you need to sign in with Google to confirm you own the channel and “unlock your Amazon Music collaboration brief,” and shows a familiar white button with the colored Google logo: Continue with Google . The site does contain genuine Google sign-in code, the same kind legitimate sites use. But it’s inactive: the setting that would connect it to Google is empty, so it never runs. Instead, clicking the button opens a full-screen frame on top of the page. The frame loads content from a second domain, youtubechannelverification[.]com . Its background is almost completely transparent, so whatever the second site draws appears to sit over the Amazon page. Meanwhile, your browser’s address bar still shows amazonyt[.]com . This is similar to what we described in our recent look at a fake Claude Max giveaway : when the sign-in window lives inside the page, the criminals control nearly everything you see. The second-stage code shows what it’s after. In the version we analyzed, it sent the email address and password entered into the form to its own server, and it supported steps for multi-factor authentication (MFA) challenges. In other words, it’s built to collect not just your password but also verification codes that could help the criminals get past an additional layer of account protection. A fake offer to keep you reassured What happens next depends on how the second stage responds. The fake window has no close button of its own. It closes only when the second-stage site tells it to. When that happens, the page displays, “Verification failed. Please try again.” However, the second-stage configuration we analyzed also pointed to a “success” address back on amazonyt[.]com . Visiting that page marks your channel as verified and returns you to the dashboard, where the offer is now unlocked: a fit score, campaign tier, budget band, estimated reach, and a pitch that quotes your recent average views back to you. You can even negotiate. A counter-offer editor lets you choose deliverables, toggle social media usage rights, and leave a note for “Amazon Music.” When you click Request this collaboration or submit your counter-offer, a “Request received” screen says the Amazon Music partnership team will review your channel and reach out with next steps. For the creator who reaches this screen, everything appears to have worked. They verified their channel, saw a convincing offer, and sent a request. That reassuring ending may give the criminals more time before the victim suspects anything. Why this campaign stands out Fake sponsorship offers have targeted creators for years. This one combines several features that make the trap more convincing: The password collection happens on a second domain. The amazonyt[.]com page itself doesn’t contain the sign-in form. That form is loaded from youtubechannelverification[.]com only after you click. A split like this can make the first page look cleaner to anyone checking it, and it lets the operators change the second stage without touching the lure. The success page is designed to evade suspicion. Victims who hand over their details aren’t left at an error page. They’re returned to an unlocked offer and a “Request received” confirmation, giving them a reason to wait for a reply. Personalization is automatic. Every visitor gets a dashboard and offer built from their own channel’s real numbers. It may be part of a reusable kit. The code contains leftover error messages that have nothing to do with this site, like “Please enter the product ID” and “This channel is not in the list, please connect the invited channel.” The link to the second stage also carries a ref value, which the second-stage code we analyzed stored as a workerCode . That could mean more than one person sends traffic to it, though we can’t confirm how the kit is shared. Why criminals want YouTube channels YouTube creators have been a target for years. In 2021, Google’s Threat Analysis Group described a campaign that lured creators with fake collaboration offers, used malware to take over their channels, and then sold them on or used them to broadcast cryptocurrency scams. A hijacked channel comes with an audience that already trusts it. That gives criminals a ready-made platform for reaching potential victims. Treat “verify your channel” requests with caution. Legitimate services may use Google’s official sign-in to confirm channel ownership. The important distinction is where you sign in: Your Google password and verification codes belong on Google’s genuine sign-in page. Check the browser’s real address bar. If you’re asked for your Google password, the actual browser tab or separate browser window should show accounts.google.com . An address bar drawn inside the webpage can be faked. Check the domain, not the logo. The domains amazonyt[.]com and youtubechannelverification[.]com are part of this phishing campaign. Familiar branding and accurate channel stats don’t make them official. Know what the real program offers. The Amazon and YouTube Shopping partnership lets eligible creators earn commissions on tagged products. A supposed Amazon Music sponsorship needs to be verified separately. Verify the offer independently. Contact the company through its official website, using contact details you find yourself rather than those supplied in the message. If you already entered your details Change your Google password through Google’s official site. Review your devices and sign out of unfamiliar sessions in your Google Account security settings, and remove any third-party apps you don’t recognize. Also check that your recovery email address and phone number haven’t changed. If you entered an MFA code or approved a sign-in prompt, treat your account as potentially compromised. In YouTube Studio, check Settings > Permissions for anyone you didn’t add. If your channel is connected to a Brand Account, check that account’s permissions too. If you’ve lost access, follow YouTube’s guidance for recovering a hacked channel , starting with the Google account associated with it. How Malwarebytes spots scams like this Once a phishing page loads, the criminals control almost everything you see, which is why it’s best to stop it before it opens. Malwarebytes Browser Guard blocks phishing and scam domains before the page can load. If you’re unsure about a sponsorship offer, you can ask Malwarebytes Scam Guard to check it before you reply or click anything. Indicators of compromise amazonyt[.]com youtubechannelverification[.]com Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser → About the author Stefan Dasic Sr. Malware Research Engineer/Web Protection Technical Lead, ThreatLabs Passionate about antivirus solutions, Stefan has been involved in malware testing and AV product QA from an early age. As part of the Malwarebytes team, Stefan is dedicated to protecting customers and ensuring their security.