Fake Amazon Music Deal Steals Creator Logins

A phishing campaign targets YouTube creators with a fake, invite-only Amazon Music advertising deal. The fraudulent site uses each creator’s real public channel statistics to appear legitimate, then places a fake Google sign-in screen over the page to capture Google passwords and multi-factor authentication codes.

Key findings

• Attackers created a fake “Amazon Artists Music, Creator Portal” offering invite-only Amazon Music advertising collaborations.
• The phishing site uses real public YouTube channel data, including subscriber counts, views, uploads, playlists, and thumbnails, to make the offer appear personalized.
• Victims are told to verify their channel using a fake “Continue with Google” flow before they can view a personalized collaboration offer.
• The fake Google sign-in form is loaded from a separate domain while the browser address bar continues to show the Amazon-themed lure domain.
• The second-stage page was built to collect email addresses, passwords, and multi-factor authentication codes.
• After credentials are submitted, victims may see a convincing unlocked offer and “Request received” message, delaying suspicion.

Who’s being targeted

• Commonly targeted roles: YouTube creators, Content creators, Influencers, Social media managers, Digital marketing teams, Brand partnership managers, Employees who manage Google Workspace or YouTube accounts.
• Affected industries: Online content creators, Digital media, Influencer marketing, Advertising and marketing.
• Attack channels: website.
• Impersonated: Amazon Music / Amazon Artists Music, Amazon Music partnership team.

Awareness takeaways

• Never enter a Google password or verification code into a sign-in screen embedded in another website; confirm that the real browser address bar shows accounts.google.com.
• Treat personalized sponsorship offers as unverified until you confirm them through the brand’s official website or known contacts.
• Check the domain rather than trusting brand logos, familiar wording, or accurate account data.
• If credentials or an MFA code were entered, immediately change the Google password and review account sessions, recovery details, third-party apps, and YouTube permissions.

Red flags to watch for

• The offer is hosted on amazonyt[.]com rather than an official Amazon domain.
• The supposed Google sign-in process appears inside the existing webpage instead of taking the user to accounts.google.com.
• The deal is presented as an invite-only Amazon Music campaign with a payout calculator and urgency to verify.
• The website uses public channel statistics as proof of legitimacy, but public data does not validate the offer.
• The page compares its estimated payout with “endless back-and-forth and delayed payments” to pressure the visitor toward its offer.
• A familiar brand logo and personalized data are used even though the domain is not official.