Key takeaways
- Channel takeovers rarely start with a guessed password. They start with a business email you were right to open — a sponsorship, a copyright notice, a policy update — and end with malware lifting the session cookie that keeps you signed in.
- A stolen session cookie walks straight past two-step verification, because the attacker never signs in. They replay a session you already authenticated.
- Google's Threat Analysis Group traced hijacked channels selling for between $3 and $4,000 depending on subscriber count, with the rest rebranded into crypto livestreams. The economics are why the lures keep coming.
- The defences that survive being fooled are structural: a separate machine or profile for opening files, passkeys, channel permissions instead of shared logins, a pruned list of connected apps.
- Chrome 146 shipped device-bound session credentials on Windows in April 2026, tying cookies to the machine's TPM so exfiltrated ones expire useless. It is the first real fix for this attack, and it is not everywhere yet.
- If it has already happened, the order is fixed: recover the Google Account, kill every session, then clean the channel — all from a device you know is not infected.
The email that takes a channel does not look like an attack. It looks like the thing you have been waiting for. A brand you have heard of, a rate slightly above what you would have asked for, a media pack attached, a deadline that is tight but not absurd. Or it looks like the thing you have been dreading: a copyright notice with your channel handle in it, your avatar at the top of the page, your most recent upload named in the body.
Both are built on the same insight. Creators are people whose job requires them to open attachments from strangers, so anything arriving dressed as business gets opened. That is not carelessness; it is the trade. Which is why the attack against creators is not a password attack at all — it is a social one, followed by malware whose only job is to steal the cookie that says you are already signed in.
What follows is what actually happens in a takeover, why "turn on 2FA" is necessary but nowhere near sufficient, what a hardening pass looks like when you have an afternoon rather than a security team, and what to do in the first hour if you are reading this because it has already happened.
The takeover does not start with your password
When you sign in to Google, the password and the second factor get you through the door once. What keeps you inside is a session cookie in your browser — a token saying this browser, on this machine, is authenticated. It is what stops Studio asking you to log in every time you open a tab.
Steal that cookie and you inherit the session. No password, no verification code, no prompt on the creator's phone. Researchers call it a pass-the-cookie attack, and it is the entire mechanism behind creator account takeovers. Google's Threat Analysis Group documented the pattern in 2021, after disrupting campaigns it had tracked since late 2019 and attributed to actors recruited through a Russian-speaking forum. The lure was a fake collaboration — an antivirus demo, a VPN, a music player, a photo editor, a game — and the payload was cookie-theft malware that ran once and exfiltrated the browser's stored sessions.
The scale in that one report is worth sitting with. Google identified at least 1,011 domains built for the campaign and roughly 15,000 accounts created purely to send the lures. It blocked 1.6 million messages to targets, showed around 62,000 Safe Browsing warnings on the phishing pages, and restored about 4,000 accounts. On account-trading markets, hijacked channels changed hands for anything from $3 to $4,000, priced on subscriber count.
Five years on the mechanism has not changed, because it still works. What has changed is the volume of the malware supply chain feeding it: Constella's 2026 identity breach report counted 51.7 million infostealer log packages processed during 2025, a 72% rise year on year. The valuable part of those logs is the live session cookies.
Why the second factor does not fire
Two-step verification protects the act of signing in. A stolen cookie skips that act. The attacker is not authenticating as you; they are resuming a session you authenticated yourself, from a browser you never see. This is also why "I would have got a prompt" is false comfort, and why the sign-out-everywhere control matters more than the password field during an incident.
The four emails that take channels
Every variant solves the same problem: get a creator to run a file, or type a Google password into a page that is not Google. Only the dressing changes.
| Lure | What it asks you to do | The tell |
|---|---|---|
| Sponsorship offer | Open the brief, contract or "product demo" attached as a .zip, .scr or double-extension file | A real brand sends a brief as a link to a document or a PDF you can preview, never an executable, and never a password-protected archive "for security" |
| Copyright or DMCA notice | Click through to a page that checks your strike status, then sign in to Google to see it | Copyright claims and strikes appear inside YouTube Studio. There is nothing to check on an external site, ever |
| Private video from "YouTube" | Watch an announcement about monetisation changes, then confirm your details on a Studio-lookalike domain | YouTube does not communicate policy changes by sharing a private video with you |
| Collaboration or beta test | Install a build, plugin or "asset pack" to evaluate before filming | Anything that has to run on your machine before money is discussed is the payload, not the pitch |
The sponsorship that wants you to open a file
This is the oldest and still the most productive lure, because it is indistinguishable in shape from real inbound. Operators register domains that resemble real companies, write a professional brief, and quote a rate slightly above market — high enough to be exciting, low enough to be plausible. The impersonated brands are the ones creators genuinely hear from. The attachment does the rest. Its close cousin is the collaboration that wants you to install a beta build, plugin or asset pack before filming: anything that has to run on your machine as a precondition of a conversation about money is the payload, not the pitch.
The defence is procedural, not perceptual: you cannot reliably spot these by reading them, so the rule has to be about what you run and where. What legitimate brand outreach looks like, and how real deals are structured, is covered in the post on getting YouTube sponsorships.
The copyright notice
Fear works faster than greed. A creator who gets a copyright email reads it in ten seconds and clicks, because a strike threatens the channel's existence. In April 2026, Malwarebytes documented a fake copyright-notice campaign that was unusually well built: every phishing link carried the target's channel handle, so the page knew who the visitor was, and it pulled their real avatar, subscriber count and most recent upload from YouTube onto a clean page titled "Copyright strikes" — then overlaid a fake Google sign-in rendered inside the page itself, a browser-in-the-browser trick that mimics a login window without opening one.
The personalisation is the point. Generic phishing is easy to dismiss; a page showing your own thumbnail and your own subscriber count reads as authenticated. If you actually have a claim or a strike, it is visible in Studio and nowhere else — the difference between the two, and what each does to a channel, is set out in the piece on copyright claims versus strikes.
The "policy update" from YouTube itself
In late February 2025, creators began receiving emails that appeared to come from a no-reply YouTube address, saying a private video had been shared with them about changes to monetisation policy. The video was an AI-generated deepfake of YouTube's chief executive, Neal Mohan, announcing the change and instructing viewers to confirm their acceptance by signing in on a Studio lookalike domain. YouTube's own warning about the campaign put the rule plainly: YouTube and its employees will never attempt to contact you or share information through a private video, and a private video claiming to be from YouTube is a phishing scam.
That rule is worth memorising, because the same structure will return with better production values: a manufactured authority figure delivering an urgent instruction is cheap to generate now. Treat the delivery mechanism — a private video, an unsolicited link to a sign-in page — as the signal, not the content.
What a stolen channel is actually used for
The resale economics tell you how much effort will be spent on you. There are three business models.
Resale. The channel is inventory, priced on subscriber count. The low end of TAG's $3 to $4,000 range explains why small channels are targeted at all: automation makes even a near-worthless channel worth stealing when the marginal cost of an attempt is close to nothing.
Crypto livestreams. The channel is renamed, avatar and banner are replaced with an exchange's or a car company's branding, existing videos are hidden, and a looped stream promises to double any cryptocurrency sent to an address. Bitdefender's 2023 research into this pattern found the ten largest hijacked channels it observed held nearly 37 million subscribers between them and roughly 10.4 billion lifetime views — all ten rebranded around Tesla, with about 1,300 scam videos tracing back to what looked like one phishing kit. By 2024 the streams had added deepfaked video and audio of Elon Musk; reporting on one in June 2024 put the take at more than $50,000 in about two hours.
Malware distribution. The subscriber base is the asset. Researchers at AhnLab's security intelligence centre have documented hijacked channels repurposed to push infostealers such as Vidar and LummaC2 to viewers, recruiting the next round of victims from an audience that trusts the channel. The loop closes on itself.
Whichever model applies, the damage is the same: videos deleted or hidden, the channel's name and packaging destroyed, strikes on content you did not upload, and an audience that watched your channel go live with a scam.
Two-step verification is the floor, not the ceiling
None of this makes 2SV optional. It stops the entire class of attacks that begins with a password reused on a breached site, and it is required on the Google Account behind any channel in the Partner Program — the monetisation requirements check for it at application. Turn it on, and prefer a passkey or security key over SMS codes: Google's guidance is consistent that those are its strongest protection against phishing, because a phishing-resistant credential cannot be typed into the wrong site.
But understand exactly what each layer buys you:
- A strong unique password defeats credential stuffing from other services' breaches.
- SMS or app-based 2SV defeats an attacker who has your password but not your phone. It does not defeat a phishing page that relays your code in real time, and it does nothing about a stolen cookie.
- Passkeys and security keys defeat phishing of the sign-in itself — no code to relay, no secret to type into a lookalike domain — but do not protect the cookie issued afterwards.
- Device-bound sessions are the layer that finally addresses the cookie.
That last one arrived properly in 2026. Chrome 146 made device-bound session credentials generally available to Windows users in April, binding cookies to a key pair generated inside the machine's Trusted Platform Module, which cannot be exported. Cookies issued under the scheme are short-lived, and the browser must prove possession of the private key to get fresh ones, so an exfiltrated cookie expires within minutes and cannot be renewed elsewhere. macOS support, using the Secure Enclave, is slated for a later release.
What device binding does not cover
It protects sessions in a browser that supports it, on a platform where it has shipped. It does nothing for an attacker who already has your credentials and has enrolled their own second factor, and nothing for malware acting inside your own logged-in browser. It raises the cost of the most common attack considerably. It does not end it.
The hardening pass, in the order that matters
An afternoon in the right order gets you most of the available protection. The ordering is deliberate: each step reduces the blast radius of the one below it failing.
1. Separate the machine that opens things from the machine that holds the channel
This is the highest-leverage change, and it costs nothing if you own two devices. The principle: the browser profile signed into your channel never opens attachments, never installs a "beta build", never follows a link from an unsolicited email. Business correspondence gets read somewhere else.
If you are one person with one laptop, approximate it: a dedicated browser profile — not a window, a separate profile with its own cookie store — for Studio and Google, another for everything else. Open documents in a web-based viewer rather than downloading them, and never run an executable from an email whatever the sender says about its format.
2. Move to phishing-resistant sign-in
Add a passkey to the Google Account that owns the channel and, where you can, drop SMS as a fallback. If the channel is your livelihood, look at Google's Advanced Protection Program, which since 2024 can be joined with passkeys rather than two purchased security keys. It applies Google's strictest settings: harder recovery, tighter limits on connected apps, aggressive download scanning. The trade-off is real — locking yourself out becomes harder to undo — which is why the next steps exist.
3. Give people permissions, not the password
Every shared login is a copy of your session on a machine whose hygiene you do not control. Studio's Permissions panel, under Settings, exists to make that unnecessary: invite people by their own Google Account, with a defined role.
| Role | Can do | Cannot do |
|---|---|---|
| Owner | Everything, including deleting the channel | — |
| Manager | Edit channel details, upload and publish, manage live streams and stream keys, invite or remove other people | Delete the channel |
| Editor | Edit channel details, upload, edit and delete draft videos, comment in Studio | Manage permissions |
| Editor (limited) | The same as Editor | See revenue data or the viewer activity tab |
| Viewer / Viewer (limited) | See Studio data; the limited variant excludes revenue | Change anything |
The Owner role is not something you hand out through the invite menu; it stays with the account that holds the channel. And a compromised editor loses you an editor, not the channel, while a shared owner password loses you everything. If your editor currently logs in as you, fixing that this week beats every other item on this list.
4. Prune the apps that already hold a key
Analytics tools, schedulers, upload automations and abandoned experiments accumulate access tokens against your Google Account, and each is a door you are not watching. On the Google Account security page, open the list of apps with account access and remove anything you do not actively use — then check it again whenever you stop paying for a tool.
5. Build the recovery kit while you still have access
Recovery is dramatically easier when Google can match what you tell it against what it already knows. While you are still in control: check that the recovery email and phone are current and yours, download backup codes and store them offline, and note the date the channel was created and roughly when AdSense was linked. Write those down outside the account, because during an incident you may not be able to look them up.
How to vet a brand email without killing the deal
The honest tension is that real sponsorships do arrive as unsolicited email from people you have never heard of, and a creator who refuses to engage with those is leaving money on the table. Vetting has to be something you do quickly, on every message, without reading the pitch charitably.
- Check the sending domain character by character. Not the display name — the domain after the @. Lookalikes use hyphens, swapped letters and extra words.
- Refuse files, accept links to documents you can preview. Archives, installers and double extensions are automatic rejections. A brief that must be downloaded and run is not a brief.
- Move the conversation to a route you initiate. Find the company's marketing contact through their real website and reply there. Attackers cannot follow you somewhere they do not control.
- Be suspicious of speed. Urgency plus an attachment plus a rate above market is the signature of the attack, not of a brand.
- Never sign in to Google from a link in a message. Navigate to Studio yourself. If a page asks for your Google password, close it.
The rule underneath all five: verification must not depend on your judgement of the message's content, because the content is the part the attacker controls and iterates on.
If it has already happened: the first hour
Move in this order. Reversing it is how creators get locked out twice.
- Switch devices. If malware took your session, the machine you are sitting at may still be running it, and everything you do from it — including a new password — goes straight back to the attacker.
- Recover the Google Account, not the channel. The channel is attached to the account; there is no separate channel login to reclaim. Start at Google's account recovery and securing flow and work through the identity questions using the kit above, from a device and location you have used before if you can.
- Reset the password and then end every other session. In the Google Account security settings, open your devices, and sign out everywhere you do not recognise. This is the step that actually evicts a cookie thief.
- Repair the second factor. Attackers add their own phone numbers, authenticator apps and recovery addresses so they can come back through the front door. Check 2-Step Verification settings and remove anything that is not yours; do the same for recovery email and phone.
- Revoke third-party access. Remove every connected app; re-add the two you actually use later.
- Check Gmail for persistence. Filters that auto-delete security alerts and forwarding rules that copy your mail elsewhere are standard, and both survive a password change.
- Then go to the channel. Studio, Settings, Permissions: remove every account you did not add. Kill any live stream and reset the stream key.
- Clean the machine. Full scan at minimum, a rebuild if the compromise came from something you ran. Until then, treat the old device as hostile.
Then follow YouTube's own hacked channel recovery guidance for the channel-specific path, including how to reach creator support. Partner Program creators have a support route non-monetised channels do not — one more argument for clearing the monetisation threshold even where ad revenue is small.
The second day: the Studio audit
Regaining access is not the end. The attacker held an account with full rights for however many hours, and the damage is spread across places that do not announce themselves.
| Where | What to look for | Action |
|---|---|---|
| Content tab | Videos set to private or unlisted, uploads you did not make, edited titles and descriptions | Restore visibility, delete their uploads immediately — anything on the channel is your responsibility under the guidelines |
| Live tab | Scheduled or completed streams, archived scam broadcasts | Delete, then reset stream keys and revoke any encoder access |
| Customisation | Channel name and handle, avatar, banner, links, description | Restore. Handle changes may be rate-limited, so check rather than assume |
| Copyright and guidelines | Strikes and claims dated during the compromise | Appeal, stating explicitly that the account was compromised and giving the window |
| Monetisation and payments | AdSense association, linked payment details, changed bank account | Verify the linked account is yours; contact support if it is not |
| Settings, Permissions | Managers and editors added during the compromise | Remove, then audit your own list |
| Comments and community | Posts and pinned comments pushing scam links | Delete, and check whether moderation settings were loosened |
Work from a written list rather than clicking around. Attackers make dozens of small changes precisely because small changes survive an emotional first pass.
What you get back, and what you do not
Be realistic about outcomes, because the recovery advice circulating online tends to promise a clean restoration that is not always available.
Access itself is usually recoverable if you act fast and can answer the identity questions — that is what Google's recovery flow is for, and TAG's roughly 4,000 restored accounts show it works at scale. Deleted content is a different matter: videos an attacker removed are not something you can restore from the interface, and whether support can help depends on circumstances you do not control. Strikes and monetisation suspensions incurred during a takeover can be appealed, and a documented compromise is a reasonable basis for one, but an appeal is a request rather than a guarantee and features may return staggered.
Subscribers lost during a rebrand largely do not come back, and neither does the momentum. A channel that spent three days broadcasting a crypto scam to its own audience has taught that audience something, and the recovery period on the performance graphs runs longer than the one on the account. That asymmetry — cheap to prevent, expensive to undo — is the argument for spending the afternoon.
Rebuilding the packaging after a takeover
The part nobody mentions is cosmetic and surprisingly laborious. Attackers replace the avatar, the banner and often the thumbnails on the most-viewed videos, because a channel that looks like an exchange converts better on a scam stream. Restoring that is not one upload: it is a banner at the right dimensions, an avatar that still reads at 48 pixels, and thumbnails matching whatever system you had.
If you kept source files, this is an hour. If you did not, it is a rebuild, and the useful reframe is to treat it as one: a deliberate pass over the channel's visual system rather than a reconstruction from memory. The rules for a coherent set are in the piece on thumbnail consistency, the mechanics of changing channel identity without losing the audience are in the rebranding guide, and the banner's safe-area requirements are in the banner size guide. Keeping source files, fonts and exports on a drive the compromised session cannot reach turns a two-day restoration into a two-hour one.
The two habits that outlast the checklist
Everything above reduces to two behaviours, and if the list is too long to act on this week, do these.
First: nothing from an email ever runs on the machine that holds the channel. Not an installer, not an archive, not a document that asks to enable anything. That single rule removes the delivery step from almost every documented creator takeover, and it does not require you to correctly identify which email is malicious — the part humans reliably fail at, especially when the email is offering money.
Second: never type your Google password anywhere you did not navigate to yourself. Studio is a bookmark. Google is a bookmark. A sign-in page that appears because you clicked something is, at best, unnecessary.
The rest is insurance on those two habits failing: passkeys so a phished credential is useless, device-bound sessions so a stolen cookie is useless, permissions so a compromised collaborator is survivable, a recovery kit so the bad day is a bad afternoon. A channel is a business asset with no lock on the door beyond the one you configure.
And if you come out the other side needing to rebuild the visual identity quickly — new avatar, new banner, a run of thumbnails that match each other rather than whatever survived — Thumblore is built for that kind of batch. It is not a security tool, and nothing above is solved by better artwork. But the day after a recovery is a day when the fastest route back to a channel that looks like itself is worth having.
For the adjacent reading: what a Community Guidelines strike does covers the appeal mechanics you may need, and the guide to spam comments deals with the other half of the ecosystem — impersonation accounts that target your viewers rather than your login.