How do hacked YouTube channels end up as scam streams?
Part of YouTube brand safety
The short answer
Hacked YouTube channels are channels taken over by someone other than their owner, through phishing or malware that steals sign-in cookies. Google has documented hijackers renaming such channels after crypto firms and streaming fake giveaways. A buyer who sees a sudden rebrand, foreign uploads or giveaway streams should exclude the channel at once and re-vet it before any return.
Key takeaways
- Google's Threat Analysis Group described fake sponsorship offers and cookie stealing malware used to take over creator channels and rebrand them for crypto scam streams.
- A peer reviewed study of giveaway scams found that 4 in 100,000 livestream views netted a victim, so a scam stream pays off only with a borrowed audience.
- The public signs are the ones YouTube lists for owners: a new name or picture, uploads that do not belong, and a sudden switch of topic.
- Google says placement exclusions typically take effect within 12 hours, so exclude at the first credible sign and re-vet before any return.
How are YouTube channels hijacked?
The clearest public account comes from Google. In October 2021 its Threat Analysis Group (opens in a new tab) described a financially motivated campaign it had disrupted since late 2019. Hack for hire actors sent creators forged business emails offering collaborations such as video ad deals. A creator who accepted got a link to fake software, such as an antivirus demo or a VPN. The malware stole browser cookies, which Google calls a pass-the-cookie attack, a session hijacking technique that gives access to accounts through cookies stored in the browser.
Definition
- Channel hijacking
- Control of a YouTube channel taken from its owner by taking over the Google Account behind it. The channel keeps its ID, subscribers and history under someone else's control.
Hijacking is one of two ways a channel can change hands behind its audience's back. The Chameleon Channels (opens in a new tab) study (USENIX Security 2026) found a market for second hand accounts with sales above USD 1 million over six months, and estimated that about 0.25 percent of sampled YouTube channels were repurposed within three months. Those channels were bought, not proven hacked, but from outside both look alike: an established audience suddenly receives new content under a new identity.
| Route | How it works | What a buyer may notice |
|---|---|---|
| Fake sponsorship lure | A forged brand deal email leads to a download carrying cookie stealing malware | Nothing until the takeover |
| Session takeover | Stolen session cookies give the attacker access to the account | Name, picture and description change within a short span |
| Resale of hijacked channels | Google reported prices of USD 3 to USD 4,000, depending on subscriber count | A large following with no visible link to the earlier creator |
| Purchase and repurposing | A bought channel gets a new identity and topic, such as crypto promotion or election news | Old videos gone, new topic unrelated to the subscribers |
What scams run on hacked YouTube channels?
Google's 2021 report names the main use: hijacked channels were renamed and given new pictures and content to impersonate large technology firms or cryptocurrency exchanges, then used to live stream cryptocurrency giveaways that asked viewers for an initial payment.
Liu and colleagues measured the economics in Give and Take (opens in a new tab), presented at ACM IMC 2024. Combining Twitter, YouTube and Twitch livestreams, landing pages and blockchain records, they found that 4 in 100,000 livestream views netted a victim, and that scammers extracted nearly USD 4.62 million from hundreds of victims in their measurement window. A tiny conversion rate works when the stream borrows an audience someone else built.
Only scammers will guarantee profits or big returns.
Regulators in both countries describe the same pattern. The FTC (opens in a new tab) warns of scammers who pretend to be a celebrity who can multiply any cryptocurrency sent to them, and who impersonate well known companies. The Canadian Anti-Fraud Centre (opens in a new tab) says fraudsters may impersonate politicians, celebrities, financial advisors or government agencies, and to be suspicious of any investment with guaranteed or risk free returns.
How can a buyer spot a hijacked channel in a plan?
YouTube's recovery guide (opens in a new tab) lists the signs an owner should look for: changes the owner did not make, such as a new profile picture, descriptions or email settings, and uploaded videos that are not theirs. Its cleanup guide (opens in a new tab) says the most frequent changes hackers make are in uploads, channel permissions and channel info. A buyer cannot see permissions, but the other two are public.
Signs that a planned channel may have been taken over
- The channel name or picture now refers to a technology company, an exchange or a token instead of the approved creator.
- The newest uploads or streams have nothing to do with the topics the channel was chosen for.
- Older videos that justified the channel's place in the plan are missing.
- A live stream promises a giveaway, doubled deposits or guaranteed returns.
- The name adds Live or Official to a well known brand, a pattern YouTube's impersonation policy names.
Campaign reporting helps once money has moved. In the Google Ads Where ads showed report (opens in a new tab), selecting channels and choosing View Details adds Placement (Group) for the channel and Placement (Detail) for the video. Google warns the report is not an exhaustive list and that placements below its thresholds may be missing, so a clean report does not prove no ad ran on the stream.
How fast should a hacked channel be removed from a plan?
When checked in October 2026, neither YouTube nor Google Ads published a response time for hijacked channels, so the speed is the buyer's call. One platform fact sets the pace: Google says new placement exclusions typically take effect within 12 hours (opens in a new tab), at the account, campaign or ad group level, with account level exclusions overriding the others. A channel excluded at the first credible sign is still live for part of a day; one excluded after a week of confirmation stays live far longer.
A removal sequence for a suspected hijacked channel
- Capture the evidence first. Save the channel URL, channel ID, screenshots of the name and stream, and the time, since the page may change within hours.
- Exclude by channel ID at account level. The ID survives renames; a name in a spreadsheet may no longer match.
- Remove it from targeting lists too. Take the channel out of placement targeting and shared lists so a later campaign does not pick it up.
- Check the reports for exposure. Open the Where ads showed details for the dates in question.
- Tell the client in plain words. Say what was seen, when the exclusion went in and what the reports show.
- Report the stream to YouTube. YouTube's reporting guide (opens in a new tab) says reported content is not automatically taken down, so a report is one input, not a fix.
This is narrower than excluding all live content, a format choice covered in the live stream ads guide. Removing a hijacked channel concerns one channel whose owner changed. Store the excluded ID in the client's channel exclusion list with the date and reason.
How does YouTube restore hacked channels?
YouTube's recovery guide sets three steps in order: recover and secure the Google Account linked to the channel, revert unwanted channel changes right away to avoid penalties such as Community Guidelines or copyright strikes, and apply security practices for everyone with access. Account recovery comes first because the channel belongs to the account.
| Stage | What YouTube says | What it means for a buyer |
|---|---|---|
| Cleanup tool | The cleanup guide says the Studio tool lists unusual activity for review at once, and a submitted review can be edited, usually for 30 days | A channel can look half restored for a while |
| Hacker uploads | Delete hacker uploads with no strikes or claims; for those with strikes or claims, contact YouTube to start an investigation | Takeover strikes may remain until YouTube reviews them |
| Support window | Support is limited to incidents within the past 9 months under YouTube's data retention policy | An old takeover may not be fully reversed |
| Terminated channels | An owner can appeal with a form after recovering the account; appeals may be rejected if recovery is incomplete | A channel that vanished may or may not return |
| Help routes | Eligible creators, such as Partner Program members, can contact Creator Support; others can ask @TeamYouTube on X | Partner Program members have a support route others lack |
The 2021 report said Google would require monetizing creators to turn on 2-Step Verification, and the current YouTube Partner Program requirements (opens in a new tab) still tell applicants to turn it on. Since the campaign Google described stole session cookies, 2-Step Verification is one layer of protection, not proof that a channel cannot be taken.
When can a restored channel go back into a plan?
A restored channel deserves a fresh review, not a quiet return, since takeover uploads or strikes may remain. Run the channel vetting checklist, then these checks.
Re-entry checks for a channel that was hijacked
- The name, picture and description match the creator the plan first approved.
- No video or stream from the takeover period is still public.
- The creator has confirmed the recovery on the channel or in writing.
- Uploads since the recovery fit the brief's topics again.
- The exclusion record shows when it went in and when and why it was lifted.
Fictional example
A password manager plan in Pennsylvania
An unnamed password manager app runs an English YouTube plan in Pennsylvania, focused on Philadelphia and Pittsburgh, on technology review, home office and online safety channels. On a Monday the planner finds a planned laptop review channel renamed after a cryptocurrency exchange, streaming a promise to double any deposit.
The planner saves the channel ID and screenshots, excludes the ID at account level, removes it from the placement list and checks the weekend's placement details. The client gets a short note with times and evidence. Three weeks later the creator posts that the channel is back; the re-entry checks find two takeover streams still public, so the exclusion stays until they are gone.
How does PlacementGraph flag a planned channel that changes?
Frequently asked questions
Is a channel that suddenly changes its name always hacked?
No. Creators rebrand, and the Chameleon Channels study found channels that were bought and repurposed rather than stolen. From outside, a sale and a hijack can look the same. For a buyer, the point is that the channel the plan approved is no longer the channel serving the ads.
Does a hijacked channel keep its subscribers?
Yes. Taking over the account keeps the channel's ID, subscribers and history, which is what makes it valuable. Google reported hijacked channels selling for USD 3 to USD 4,000 depending on subscriber count, and the Chameleon Channels authors found resold channels that appeared to gain subscribers rather than lose them.
Where should a viewer report a crypto giveaway scam seen on YouTube?
On YouTube, through the report option on the video or stream. Outside the platform, the FTC points US viewers to ReportFraud.ftc.gov, and the Canadian Anti-Fraud Centre asks Canadians to report to local police and to the centre.
Can strikes from a hijack stay on a recovered channel?
They can until YouTube reviews them. The cleanup guide tells owners to delete hacker uploads that carry no strikes or claims, and to contact YouTube to start an investigation for uploads that do. A recovered channel may therefore show restrictions for a time that came from the takeover rather than from the creator.
Sources
- Phishing campaign targets YouTube creators with cookie theft malware (opens in a new tab)Google Threat Analysis Group, October 20, 2021
- Chameleon Channels: Measuring YouTube Accounts Repurposed for Deception and Profit (opens in a new tab)Cuevas, Horta Ribeiro and Christin, arXiv 2507.16045, USENIX Security 2026
- Give and Take: An End-To-End Investigation of Giveaway Scam Conversion Rates (opens in a new tab)Liu et al., arXiv 2405.09757, ACM IMC 2024
- Recover a hacked YouTube channel (opens in a new tab)YouTube Help
- Clean up a hacked YouTube channel (opens in a new tab)YouTube Help
- Impersonation policy (opens in a new tab)YouTube Help
- What To Know About Cryptocurrency and Scams (opens in a new tab)US Federal Trade Commission, Consumer Advice, May 2022
- Investment and crypto investment fraud (opens in a new tab)Canadian Anti-Fraud Centre, modified October 1, 2025
- About placement exclusions (opens in a new tab)Google Ads Help
- About the Where ads showed report (opens in a new tab)Google Ads Help
- Report inappropriate videos, channels and other content on YouTube (opens in a new tab)YouTube Help
- YouTube Partner Program overview and eligibility (opens in a new tab)YouTube Help
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.