I've recently been getting some emails that look
convincingly like messages from YouTube,
asking me to confirm my account.
Look! It says it's from YouTube
and the text reads like something from a YouTube email
and the link to click on to confirm my account
is a link on YouTube's website.
Except it's not.
The text of the link, certainly is a youtube.com address.
Though, it doesn't go anywhere
but the website the link goes to when you click on it
is definitely, not YouTube.
Now, most people know that you can put a link to any
address on any text you want.
but this phishing attack is maliciously taking advantage
of the fact that, typically when you paste a link into an
email, it automatically just links to that link.
So, we've all habituated to think that if we see a link and
click on it. We're going to that address.
But of course, in this case.
We're not.
The site this link takes you to
looks convincingly like YouTube
but the URL definitely isn't and if you clicked on the link
without looking carefully and didn't pay attention to the address
you might even try to log into this fake Google login
and then... I don't know what happens
but I bet it's not good.
because you just gave your Gmail YouTube login away to a malicious stranger
If anyone watching this video is clever enough to
figure out, exactly what these attack sites do
or, who's behind them.
I'm all ears
or, if you work for YouTube.
Perhaps you could send out a message to all
of you users, warning of attack sites like this
but for now, just know that if you see an email
that looks like it's from YouTube asking you
to verify your account information
DON'T CLICK ON THE LINK