YouTube has warned that scammers are using fake videos made by AI, showing YouTube's CEO, to trick people into giving away their account details.
The scammers are sending these videos in emails that seem to say YouTube is changing its rules about making money on the platform. The emails include a link to a private video that looks like it's from YouTube.
YouTube says in a post that it will never send you private videos or ask for information this way. If you get a private video claiming to be from YouTube, it's a scam.
The phishing emails also warn you that YouTube won't contact you through private videos. The email tells you to report the sender if you think the email looks fake.
The fake video in the email asks you to click a link. This link takes you to a fake page that looks like YouTube, where it asks you to log in to "confirm new rules." But the page is actually designed to steal your login details.
Technical details of the phishing attack involving AI-generated videos:
Fake AI-Generated Video
Scammers create an AI-generated video that mimics YouTube's CEO, Neal Mohan.
The video is shared privately with targeted users via email, making it seem
like a legitimate message from YouTube.
Phishing Email:
The phishing emails claim that YouTube is changing its monetization
policies.
The emails contain a private video link, designed to look like it’s from
YouTube, asking the recipient to watch it.
The fake page mimics a legitimate YouTube login page.
Credential Stealing:
The page asks users to sign in and “confirm the updated YouTube Partner
Program (YPP) terms.”
When the user enters their credentials, the attackers capture the login
details.
Mimicking YouTube's Interface:
The fake login page looks similar to YouTube’s real login page but is
designed to steal usernames, passwords, and other sensitive information when
users log in.
Impact:
If successful, the attackers gain unauthorized access to users’ YouTube
accounts, potentially leading to the theft of personal data or hijacking of
channels.
This attack relies on the combination of AI-generated content and phishing
techniques to create a sense of urgency and trust, tricking users into sharing
their credentials.