This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Scammers are conducting a widespread phishing campaign targeting YouTube creators by using AI-generated deepfake videos of YouTube CEO Neal Mohan. The videos falsely announce changes to monetization policies, tricking creators into clicking malicious links or downloading malware to steal credentials and hijack accounts. YouTube has issued an official warning, clarifying that they do not communicate platform changes via private videos.
Scammers are reportedly using an AI-generated deepfake of YouTube CEO Neal Mohan to steal user credentials. The fake video announces false changes to YouTube’s monetization policy, and it then tricks creators into clicking malicious links or downloading malware. The scam spreads through private videos and emails from a fake YouTube address. It exploits platform features to appear legitimate. Victims risk losing account access or exposing sensitive data.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
The incident involves scammers using AI-generated deepfakes of YouTube's CEO to conduct a targeted phishing campaign to steal credentials and hijack accounts, which falls under fraud and targeted manipulation.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human scammers intentionally using deployed AI deepfake technology to deceive YouTube creators.
Added categories peak at 2: Minor (Epistemic Harm, Direct)
Cybercriminals utilized AI-generated deepfakes of YouTube's CEO in a widespread phishing campaign targeting content creators. While representing an evolved capability in scaling synthetic media for fraud, the incident remains a commercial cybercrime issue with minor national security implications.
The AI system was used as a tool to generate a realistic deepfake video and voice clone of the YouTube CEO. The reports describe it as 'AI-generated deepfake videos' and 'sophisticated AI models trained on real footage and voice samples' used by threat actors to execute their scam.
Limited Risk: The incident involves 'AI-generated content such as deepfakes' which require transparency obligations under the EU AI Act to ensure users are aware they are interacting with synthetic media.
The AI system was used to generate a highly realistic deepfake video of YouTube's CEO, mimicking his appearance, voice, and mannerisms.
The reports consistently describe the phishing campaign, the use of the deepfake video of YouTube's CEO, and the mechanism of the scam (credential theft and malware). There is no conflicting information, and the role of the AI is clearly defined as a tool for generating the deceptive video.
None. The reports clearly point to a phishing scam leveraging deepfake technology.
Technology
Realistic Deepfake Generation
AI models mimicked CEO voice and appearance with high accuracy.
Exploitation of In-Platform Features
Phishers abused private video sharing to distribute malicious links.
Data Inputs
Public Training Data Availability
AI models were trained on public footage and voice samples of the CEO.
Human Factors
Trust in Public Figures
Creators trusted the realistic depiction of YouTube's CEO.
Fear of Monetization Loss
Creators acted quickly due to high reliance on platform income.
Difficulty in Spotting Deepfakes
Tech-savvy individuals struggle to distinguish fake from real footage.
Process and Methods
Abuse of Private Video Sharing
In-platform features allowed sharing private videos with external links.
Email Spoofing
Emails delivered phishing hooks by appearing to come from official source.
AI system involved
An AI system was involved, but the reports do not identify it.
Identified by automated extraction; can differ from the alleged developers above.
