On Oct. 21, 2026, Malwarebytes reported a fake invitation-only Amazon Music advertising offer targeting YouTube creators. The reported portal used public channel details to personalize its pitch, then opened a staged Google sign-in flow. Malwarebytes says the version it analyzed sent submitted email addresses and passwords to its server and supported multi-factor authentication (MFA) challenges.
Public channel details made the pitch feel personal
The reported portal asked creators for a YouTube channel link, then displayed public information such as subscriber and view counts, uploads, playlists, topics, and thumbnails. Malwarebytes says the site queried YouTube’s public API from the visitor’s browser. Its analyzed code contained 20 Google API keys and rotated among them when a key was rejected or reached its usage limit.
That visible familiarity could make an unsolicited pitch feel tailored. The portal also listed four advertising packages: a Shorts campaign, an integration in a planned video, a dedicated video, and a full campaign. It included an earnings calculator and offered nine interface languages, including English and Spanish.
The Google sign-in prompt used a second domain
Malwarebytes identified the reported portal’s first domain as amazonyt[.]com and its second as youtubechannelverification[.]com. When a visitor selected the fake “Continue with Google” control, the page reportedly opened a full-screen sign-in frame from the second domain while the browser address bar continued to show the first.
Malwarebytes says the second-stage code it analyzed sent entered email addresses and passwords to its server and could handle MFA challenges. The report also describes a post-login flow that could reveal a personalized offer and display a request confirmation.
The confirmation screen could make the interaction appear complete. It showed a “Request received” message, according to the reported capture.
The real Amazon feature is product tagging in YouTube Shopping
The legitimate Amazon feature is an affiliate shopping program, not an Amazon Music advertising offer. YouTube Creators’ announcement, published Aug. 27, 2026, describes product tagging for eligible US creators enrolled in YouTube Shopping who have an active Amazon Influencer Program or Amazon Associates Program account. Tags can appear in videos, Shorts, and livestreams. Malwarebytes says legitimate account linking takes place through an existing Amazon account, with tagging confirmed in YouTube Studio.
The reported fake portal instead asked for a channel link and Google sign-in to pursue an invitation-only advertising deal.
| Detail | Legitimate YouTube Shopping feature | Reported fake Amazon Music offer |
| Purpose | Tag Amazon products through an affiliate shopping feature | Promote an invitation-only Amazon Music advertising collaboration |
| Eligibility or entry | Eligible US creators enrolled in YouTube Shopping, with an active Amazon Influencer Program or Amazon Associates Program account | A creator submits a YouTube channel link, then the portal requests Google sign-in |
| Account flow | Linking through an existing Amazon account; YouTube Studio confirms tagging is enabled | A sign-in frame reportedly loads from a second domain while the browser shows the first |
| Formats | Product tags in videos, Shorts, and livestreams | Four advertised packages, including Shorts and video integrations |
What to do after entering a password or MFA code
If you entered your Google password, change it, review your devices and active sessions, remove unfamiliar third-party access, and check your account recovery details and YouTube Studio permissions. Malwarebytes advises treating an entered MFA code or an approved sign-in prompt as a possible account compromise. If you lose access to your channel, use YouTube’s hacked-channel recovery guidance.
