The fake sponsorship page already knows your subscriber count

It greets you with your own thumbnails. Your subscriber number, your view total, your upload count, all correct. That is not a breach, it is the public YouTube API, which anyone can query, but the effect on a creator reading an invitation-only sponsorship offer is exactly what the people behind amazonyt.com were going for.

Stefan Dasic at Malwarebytes documented the campaign this week. The site calls itself the Amazon Artists Music Creator Portal and leans on something real: Amazon and YouTube did announce a Shopping Affiliate partnership back in August. There is an earnings calculator with packages and optional boosters, and the whole thing is translated into nine languages, among them Spanish, Portuguese, Indonesian, Arabic, Hindi and Urdu. To see your personalised offer, you are asked to verify the channel with Google.

The verify button is the trap, and it is a careful one. It does not send you anywhere. It lays a transparent frame from a second domain, youtubechannelverification.com, over the page you are already on, so the address bar keeps showing amazonyt.com while you type. The form takes the password and then the two-factor code. Afterwards you either get "Verification failed" or a reassuring "Request received", depending on how the operators have set it that day.

Two things are worth fixing in your head. Google sign-in happens on a Google address and nowhere else, and YouTube never asks a third-party site to verify your channel. The address bar is the one part of a page an attacker cannot repaint, so read it before you type rather than after. If you think you did hand the password over, change it and go through your Google account's connected apps. Tendvane's Privacy and accounts check covers the accounts signed in on your PC and the settings around them, which is a sensible next stop.