Fake YouTube copyright notices can steal your Google login

A phishing-as-a-service campaign is targeting YouTube creators with convincing fake copyright strike notifications that pull real channel data and present a browser-in-the-browser Google sign-in overlay to harvest credentials. The kit uses rotating domains, affiliate tracking, and evasion (skipping very large channels) to scale and persist; several domains (dmca-notification.info, blacklivesmattergood4.com, dopozj.net, ec40pr.net, xddlov.net) are listed as IOCs, and the report provides detection and remediation guidance for affected creators.