YouTube has issued a warning about a new phishing scam where cybercriminals are using an AI-generated video of CEO Neal Mohan to deceive content creators and steal their credentials. The scammers distribute the video privately through emails, falsely claiming that YouTube is implementing changes to its monetization policy.
"We're aware that phishers have been sharing private videos to send false videos, including an AI-generated video of YouTube’s CEO Neal Mohan announcing changes in monetization," YouTube stated in a pinned post on its official community website.
"YouTube and its employees will never attempt to contact you or share information through a private video. If a video is shared privately with you claiming to be from YouTube, the video is a phishing scam."
Ironically, the phishing emails warn recipients that YouTube will never contact users through private videos, urging them to report suspicious emails.
The fraudulent video’s description contains a malicious link directing users to a fake YouTube Partner Program (YPP) page (studio.youtube-plus[.]com). Here, creators are prompted to sign in to “confirm updated terms” to continue monetizing their content. However, this site is designed to steal login credentials. The scam also induces urgency, falsely stating that accounts will face restrictions—including an inability to upload or edit videos and receive monetization—if compliance is not confirmed within seven days. Once login details are entered, victims receive a message stating their channel is "pending" and are directed to open a document in the video description for more information, even if they input a random email and password.
These phishing emails have been circulating since late January, with YouTube confirming an investigation into the campaign beginning in mid-February. The company advises users to avoid clicking any embedded links, as they may redirect to phishing sites or install malware.
"Many phishers actively target creators by trying to find ways to impersonate YouTube by exploiting in-platform features to link to malicious content," the platform added. "Please always be aware and make sure not to open untrusted links or files!"
Several creators have already fallen victim to the scam, reporting that their channels were hijacked and used to broadcast live cryptocurrency fraud streams.
YouTube offers guidelines on identifying and reporting phishing attempts through its help center. Additionally, since August 2024, the platform has introduced a support assistant to aid users in recovering and securing compromised accounts.