Phishers Allegedly Using AI-Generated Video of YouTube CEO Neal Mohan to Target Creators

Scammers are reportedly using an AI-generated deepfake of YouTube CEO Neal Mohan to steal user credentials. The fake video announces false changes to YouTube’s monetization policy, and it then tricks creators into clicking malicious links or downloading malware. The scam spreads through private videos and emails from a fake YouTube address. It exploits platform features to appear legitimate. Victims risk losing account access or exposing sensitive data.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves scammers using AI-generated deepfakes of YouTube's CEO to conduct a targeted phishing campaign to steal credentials and hijack accounts, which falls under fraud and targeted manipulation.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human scammers intentionally using deployed AI deepfake technology to deceive YouTube creators.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The incident involves 'AI-generated content such as deepfakes' which require transparency obligations under the EU AI Act to ensure users are aware they are interacting with synthetic media.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Unknown scammers, Scammers impersonating Neal Mohan, Phishers
• Alleged harmed parties: YouTube users, YouTube creators, YouTube account holders

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: Yes, the reports describe the creation and distribution of a malicious deepfake video used for phishing.

Directly caused: An AI-generated deepfake video of YouTube's CEO Neal Mohan was created and shared privately with creators to execute a phishing scam.

Inferred additional harm: It is likely that multiple variations of the deepfake video were distributed to thousands of creators across the platform.

Privacy

Reported: Yes, the reports describe the theft of credentials and session cookies.

Directly caused: The phishing scam aimed to steal creators' login credentials and session cookies to hijack their accounts.

Inferred additional harm: Attackers gaining access to hijacked accounts could access private personal and financial information of the affected creators.

Epistemic

Reported: Yes, the reports describe a deepfake video fabricating an announcement about monetization changes.

Directly caused: The deepfake video falsely depicted the YouTube CEO announcing fake changes to the platform's payout and monetization policies.

Inferred additional harm: The scam could erode trust in official YouTube communications and the authenticity of video announcements from public figures.

People affected

• Occurrences reported: 1
• People reportedly harmed: 10
• People reportedly exposed: 1000

Potential causes

Technology

• Realistic Deepfake Generation: AI models mimicked CEO voice and appearance with high accuracy.
• Exploitation of In-Platform Features: Phishers abused private video sharing to distribute malicious links.

Data Inputs

• Public Training Data Availability: AI models were trained on public footage and voice samples of the CEO.

Human Factors

• Trust in Public Figures: Creators trusted the realistic depiction of YouTube's CEO.
• Fear of Monetization Loss: Creators acted quickly due to high reliance on platform income.
• Difficulty in Spotting Deepfakes: Tech-savvy individuals struggle to distinguish fake from real footage.

Process and Methods

• Abuse of Private Video Sharing: In-platform features allowed sharing private videos with external links.
• Email Spoofing: Emails delivered phishing hooks by appearing to come from official source.

Information quality

• Classification confidence: High
• Reason for confidence: The reports consistently describe the phishing campaign, the use of the deepfake video of YouTube's CEO, and the mechanism of the scam (credential theft and malware). There is no conflicting information, and the role of the AI is clearly defined as a tool for generating the deceptive video.
• Ambiguities identified: The exact AI model used to generate the deepfake is not specified.
• Alternative interpretations: None. The reports clearly point to a phishing scam leveraging deepfake technology.

Cybercriminals utilized AI-generated deepfakes of YouTube's CEO in a widespread phishing campaign targeting content creators. While representing an evolved capability in scaling synthetic media for fraud, the incident remains a commercial cybercrime issue with minor national security implications.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Global YouTube creator community
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. This represents an ongoing strategic trend in cybercrime capabilities rather than an active national security crisis requiring immediate government intervention.
• Autonomy: Human-controlled. The AI system was strictly used as a tool to generate synthetic media (video and voice), with human scammers directing the entire phishing operation.
• Novelty: Evolved capability. Represents a significant evolution where deepfakes, previously reserved for high-value targeted spear-phishing, are scaled for broader audience phishing campaigns.

Impact by dimension

• Physical security: Negligible. The incident is entirely digital and commercial, posing no threat to physical systems, critical infrastructure, or human safety.
• Information security: Minor. While using advanced deepfake technology to deceive users, the campaign is a commercial phishing scam rather than a state-sponsored information warfare or intelligence operation.
• Sovereignty: Negligible. No government systems, electoral processes, or state sovereignty functions were targeted or affected by this incident.
• Economic security: Minor. The incident targets individual content creators' accounts and monetization, representing minor economic fraud rather than a threat to national strategic industries or financial systems.
• Societal stability: Negligible. The incident is a localized cybercrime campaign targeting a specific user group and does not threaten broader social cohesion, civil liberties, or societal stability.