A fake Amazon Music sponsorship portal is using YouTube creators’ real videos and viewing figures to make a Google-password trap look like a tailored business offer. In research published on October 21, Malwarebytes traced a page that builds a convincing channel dashboard from public data, then puts the supposed deal behind a fraudulent sign-in step.[1] The useful warning is specific: knowing your channel does not prove that a sponsor knows you.
The reported domains are amazonyt[.]com and youtubechannelverification[.]com. A creator who entered a password or verification code should secure the Google account through an independently opened official page, then check access to the channel.
A real partnership gives the fake offer a foothold
There is a genuine Amazon–YouTube relationship to borrow from. YouTube announced Amazon’s addition to its Shopping Affiliate Program on August 27, initially for eligible U.S. creators. That program lets creators tag products and earn sales commissions.[2] It gives an unsolicited Amazon-themed approach a plausible backdrop, but it does not authenticate a separate Amazon Music sponsorship.
The page examined by Malwarebytes instead promises invitation-only advertising work. Its payout calculator lets a visitor choose video packages and adjust the proposed work. The numbers change as expected. That small piece of functioning software makes the commercial pitch feel more substantial before any account information is requested.
The dashboard knows your videos because they are public
After a creator supplies a channel link, the portal displays genuine thumbnails, uploads, subscriber totals and viewing figures. Malwarebytes found that it retrieves this information through YouTube’s public API; the analyzed code contains 20 API keys and can switch between them when a key stops working.
This is the first trust boundary in the story. Public channel statistics can be assembled by someone with no connection to Amazon and no access to the creator’s private account. A tailored dashboard is therefore evidence that the page looked up a channel, not that a brand approved a campaign. The locked offer turns that familiarity into a reason to continue.
Example
The following invitation is illustrative; the published investigation did not provide an original outreach email or its sender headers.
Subject: Amazon Music collaboration invitation
From: Creator Partnerships <offers [at] example [dot] invalid>
Hello creator,
We would like to discuss an Amazon Music collaboration with your YouTube channel. Open your creator portal, add your channel link, and verify your channel with Google to view the offer.
Button: View collaboration
The Google window belongs to the webpage
The next screen asks the visitor to verify channel ownership. Although the lure includes genuine Google sign-in code, Malwarebytes found that the configuration needed to activate it is empty. The button instead loads an attacker-controlled frame from the second domain over the original page.
The outer browser address remains on the fake sponsor’s domain. The apparent Google address inside the smaller window is part of what the webpage draws. This is the same kind of visual trust confusion seen in the separate Claude Max giveaway phishing case; it does not establish a connection between the operators.
In the second-stage version the researchers analyzed, entered email addresses and passwords were sent to the attacker’s server, and the code supported additional authentication challenges. A familiar-looking verification prompt can therefore be another collection step. The report does not establish a victim total, a universal MFA bypass, or that every visitor lost a channel.
The offer can unlock after the trap
The analyzed configuration also points to a return page that marks verification as successful and reveals the promised offer. A creator can adjust deliverables, negotiate and receive a submission confirmation. This is a useful reversal: a polished ending can reassure someone precisely when they should be checking their account. A working offer screen does not undo the credentials already submitted elsewhere.
Check the program and recover through separate routes
For the real Shopping integration, Google’s setup guide describes connecting accounts through Amazon and receiving confirmation in YouTube Studio.[3] Open those services independently. If a page requests your Google password, inspect the browser’s actual address bar for Google’s sign-in host, accounts.google.com, rather than a bar drawn inside the page. Branding, channel statistics and a padlock on an unrelated domain cannot establish who is collecting the password.
If you submitted credentials, change the password through Google’s official account controls, review unfamiliar devices and third-party access, and inspect channel permissions in YouTube Studio. If access is lost, YouTube’s recovery guidance starts with the associated Google account and then addresses unauthorized channel changes.[4] Review access even after changing a password: our session-access explanation covers why account recovery involves more than one secret.
The strongest part of this lure is not a misspelled email. It is an accurate picture of the creator’s own work. Verify the sponsor and the sign-in destination through information the invitation does not control.
References
- Stefan Dasic. Investigation of the fake Amazon Music creator portal. Malwarebytes ThreatLabs, October 21, 2026.
- Travis Katz. Amazon joins YouTube Shopping. YouTube Official Blog, August 27, 2026.
- Google. Amazon product tagging setup. YouTube Help; accessed October 21, 2026.
- Google. Recover a hacked YouTube channel. YouTube Help; accessed October 21, 2026.
