iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Scammers have targeted YouTube creators with fake business offers and other convincing messages, then used phishing or malicious downloads to steal account credentials or browser session cookies. After taking control of a channel, they can exploit its established audience by rebranding it and promoting cryptocurrency scams. Google documented one such campaign in 2021; the FBI warned in 2024 that influencer-account hijackings remain a way to spread scams and malicious software. The tactics vary, and a crypto promotion is not fraudulent simply because it appears on YouTube.
How the creator-targeting campaign worked
Google’s Threat Analysis Group (TAG) said a financially motivated phishing campaign targeting YouTubers had been active since late 2019. In its October 20, 2021 account, Google described attackers sending forged business emails that impersonated real companies and offered collaboration opportunities. The pitches often proposed demonstrating software such as antivirus tools, VPNs, music players, photo editors, or games.
A convincing offer can be the first step in an account takeover. The recipient may be led to a phishing page that asks for login details or to download a file presented as part of the collaboration. Google said malware used in the campaign could steal passwords and browser cookies. A stolen session cookie can let an attacker hijack an already authenticated session, potentially bypassing the need to enter a password at that moment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →This describes the campaign Google investigated, not a universal method. Other incidents may use different forms of phishing or social engineering, and not every creator who receives a suspicious message has been infected or compromised.
#1 Best Overall
What attackers do with a hijacked channel
Google reported that compromised channels were often renamed and given cryptocurrency-themed profile images and content that imitated technology companies or cryptocurrency exchanges. Attackers used livestreams to promise cryptocurrency giveaways in exchange for an initial contribution. The familiar channel and its existing audience could make a fraudulent appeal appear more credible than it would on a newly created account.
The FBI’s Atlanta Division warned on October 16, 2024, that established and verified influencer accounts were being taken over through targeted phishing or social engineering, then used to distribute cryptocurrency scams and malicious software. A verification badge or familiar channel identity does not establish that the legitimate owner currently controls a particular post, livestream, or link.
Google TAG reported that hijacked channels were being traded on account markets for prices ranging from $3 to $4,000 USD, depending on subscriber count. That was a historical range reported in 2021, not a current price estimate.
What the 2021 figures do—and do not—show
Google TAG reported these figures for its response to the campaign it investigated:
- Google measured a 99.6% reduction in the volume of related phishing emails on Gmail since May 2021.
- Google said it blocked 1.6 million messages aimed at targets and displayed approximately 62,000 Safe Browsing warnings for phishing pages.
- Google reported blocking 2,400 files and restoring approximately 4,000 accounts.
These are Google’s historical campaign-response measurements, published in 2021. They are not estimates of current global phishing activity, the total number of affected creators, or the likelihood that any particular channel will be attacked.
How creators can reduce the risk of a takeover
YouTube’s account-security guidance recommends layered protections. No single measure prevents every route to compromise, especially if a device has malware or a creator is tricked into approving access.
Rank #4
- WHAT DOES IT COVER: Roll once over names, addresses, account numbers, barcodes, and prescription details on mail, statements, shipping labels, and boxes before recycling. The patented 0.5" masking pattern hides 3 lines of text in one pass.
- HOW MANY USES DO YOU GET: Each pre-inked Guard Your ID Advanced Roller delivers about 1,000 impressions (roughly 100 feet of coverage). A twist-on cap keeps the ink fresh for a 2-year shelf life, so it is ready whenever the mail arrives.
- DOES IT WORK ON GLOSSY LABELS: Yes, on most glossy and coated surfaces, plus paper, envelopes, junk mail, and prescription labels. Give the ink 10 to 15 seconds to dry on slick surfaces; it is instant on paper. Results vary by coating.
- IS IT REFILLABLE: No, and that is the point. The Advanced Roller is pre-inked and sealed, so there are no refill cartridges to buy, no ink bottles to handle, and nothing to dry out on the shelf. When one runs out, reach for the next roller.
- SHREDDER OR ROLLER: No jams, no paper dust, no noise, and the page stays intact and recyclable. Covers boxes and shipping labels a shredder cannot. Faster than a redacting marker, fits in a drawer. White roller.
Strengthen sign-in and recovery
- Use a strong, unique password and enable two-step verification on the Google Account associated with the channel.
- Consider a passkey: YouTube identifies passkeys as its strongest phishing protection among the listed sign-in methods. YouTube also lists physical security keys, Google prompts, authenticator codes, phone codes, and backup codes. It describes passkeys and security keys as strong against phishing, while phone verification codes and backup codes are less secure.
- Add and keep current recovery phone and email options so you have a route to regain access.
- Review login activity, connected devices, and connected applications; remove access you do not recognize or no longer need.
A physical security key is an optional sign-in accessory, not a cure for malware and not a guarantee against account takeover. Check that the key works with the account and devices you use, and plan how you will sign in if it is lost or unavailable. YouTube’s guidance does not endorse a particular brand.
Recommended Free Tools
Check offers before opening files or signing in
YouTube warns that phishers target creators by impersonating YouTube or using in-platform features to link to malicious content. Treat unexpected collaboration proposals, monetization notices, private-video invitations, and prompts to sign in again as untrusted until independently verified. A display name or sender label can look official even when the originating channel or linked page is not.
Best Value
- WHAT DOES IT COVER: Roll once over names, addresses, account numbers, barcodes, and prescription details on mail, statements, shipping labels, and boxes before recycling. The patented 0.5" masking pattern hides 3 lines of text in one pass.
- HOW MANY USES DO YOU GET: Each pre-inked Guard Your ID Advanced Roller delivers about 1,000 impressions (roughly 100 feet of coverage). A twist-on cap keeps the ink fresh for a 2-year shelf life, so it is ready whenever the mail arrives.
- DOES IT WORK ON GLOSSY LABELS: Yes, on most glossy and coated surfaces, plus paper, envelopes, junk mail, and prescription labels. Give the ink 10 to 15 seconds to dry on slick surfaces; it is instant on paper. Results vary by coating.
- IS IT REFILLABLE: No, and that is the point. The Advanced Roller is pre-inked and sealed, so there are no refill cartridges to buy, no ink bottles to handle, and nothing to dry out on the shelf. When one runs out, reach for the next roller.
- SHREDDER OR ROLLER: No jams, no paper dust, no noise, and the page stays intact and recyclable. Covers boxes and shipping labels a shredder cannot. Faster than a redacting marker, fits in a drawer. Black roller.
- Verify the company and the offer through a contact method or website you locate independently, rather than relying on links or contact details in the message.
- Do not install software or open files from unknown sources. Be especially cautious if someone asks you to ignore browser or antivirus warnings; encrypted archives and persuasive explanations do not make an unfamiliar download safe.
- Keep device protections current, scan for malware, and consider Enhanced Safe Browsing as YouTube advises.
Act promptly if access looks compromised
If you suspect a YouTube channel has been taken over, use YouTube’s official hacked-channel help and Google Account recovery routes. Secure the associated account, check its recovery details and connected apps, and scan the devices used to access it. Do not trust unsolicited messages from people offering account recovery or promising to recover lost money for a fee; the FBI warns that recovery fraud can follow investment fraud.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How viewers can assess a suspicious crypto promotion
Pause before following an urgent link, sending funds, installing “free” software, or responding to a giveaway request—even if it appears on a familiar or verified channel. Confirm an unusual announcement through a creator’s independently established official website or another channel you reach without using the suspicious post’s links. If you cannot verify who controls the promotion, do not treat the channel’s history as proof that it is legitimate.
The FBI’s cryptocurrency investment-fraud guidance describes a broader pattern that can begin with an advertisement or social approach and direct a person to a fake investment platform. A displayed balance or apparent early gain may encourage larger deposits. Later demands for extra money—such as fees to release funds—are a serious warning sign. This describes a type of investment fraud; it does not mean every hijacked channel uses that exact scheme or that every cryptocurrency promotion is fraudulent.
What to do if you sent money to an investment scam
The FBI advises victims of suspected cryptocurrency investment fraud to stop sending money and report the incident to the Internet Crime Complaint Center (IC3). Preserve details that can help document what happened:
- Messages, emails, and other communications with the people involved.
- The website domain and any relevant account or contact information.
- Wallet addresses and transaction hashes.
- The amount and currency sent, along with the date and time of each transaction.
Do not pay a stranger who claims a fee will unlock funds or guarantee recovery. Retaining transaction and communication records is more useful than making another payment in response to a promise.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
