The 3-Step Emergency Plan If Your Account Gets Hijacked

How to Get Rid of YouTube Strikes?

Download Free Checklist

To protect your YouTube channel from hackers, you need a Google Account that a stolen password can't open, a habit of checking brand emails before you open anything, and a plan for the moment you've already clicked. Most hacks that AIR Media-Tech's Safety team handles start with something the creator did, like giving away access or opening a file from a fake advertiser.

The fake advertiser route is the busiest one right now. The file steals your signed-in browser session, so the hacker gets in without your password and without a 2-Step Verification prompt. Google’s Threat Analysis Group has tracked campaigns against creators built this way, and in October 2026, Malwarebytes found a fake Amazon Music deal that asked creators to verify their channel through a fake Google sign-in.

The three steps below go in the order you’ll need them. If your channel is already taken, start with our guide on what to do when your YouTube channel is hacked instead.

Step 1: Lock your Google Account before anyone tries

Your channel belongs to a Google Account, so hackers go after the account. Close the easy ways in first.

• Add a passkey. A passkey signs you in with your fingerprint, face, or screen lock, so there’s no password to steal on a fake sign-in page.
• Keep 2-Step Verification on, but drop text messages. 2-Step Verification through Google prompts, an authenticator app, or a security key is much harder to intercept than an SMS code.
• Update your recovery phone and email. Recovery info is how you get back in if you’re locked out. A recovery email you didn’t add is often the first sign of a hack.
• Use a long password you don’t use anywhere else. A password manager remembers it for you.
• Turn on Enhanced Safe Browsing in Chrome. It warns you about dangerous downloads and fake sign-in pages before they open.
• Add Password Alert to Chrome. Google’s Password Alert warns you when you type your Google password on a site that isn’t Google’s. 
• Keep your login email private. Put a separate address on your channel for brand deals, so fake offers never reach the inbox that controls the channel.
• Run Google’s Security Checkup every week. Security Checkup shows devices, apps, and sign-ins you don’t recognize.
• Let your system, browser, and antivirus update automatically. Old versions have holes that malware uses.

If your channel is big enough to be a target on its own, look at Google’s Advanced Protection Program. YouTube suggests it in its own security advice for creators.

These settings protect the sign-in. They don’t help once malware has copied a session that’s already signed in, because the hacker never sees a sign-in prompt. That’s why Step 2 is about the email that brings the malware.

Give your team roles, not your password

In AIR Media-Tech’s Safety team’s work, the most common way in is access the creator gave away. A password or a verification code sent to an editor or a growth service is enough. Channel permissions let people work on your channel without your Google Account.

• Owner stays with you.
• Manager is for the one or two people who run the channel with you. Managers can publish, delete videos, and manage permissions, but they can’t delete the channel.
• Editor fits editors and freelancers. Editors can upload and publish, but they can’t delete published videos or change permissions.
• Editor (Limited) and Viewer (Limited) hide revenue data from people who don’t need it.

Every account on that list is a way in, so ask everyone to turn on 2-Step Verification and remove people who no longer work with you. Anastasiia Kulyk, Safety Team Lead at AIR Media-Tech, an official YouTube partner, adds one more rule. Work only with people you’ve checked. Separate accounts for your team help, but they don’t fully protect the channel on their own.

Step 2: Spot a fake sponsorship email before you open anything

In March 2023, someone on the Linus Media Group team opened a PDF from what looked like a sponsor. The file copied the browser session, and within hours Linus Tech Tips and two sister channels were renamed and streaming crypto scams. Nobody needed a password or a 2-Step Verification code. We’ve put more stories like this in our list of famous YouTubers who got hacked.

Smaller channels get the same emails. AIR Media-Tech’s Safety team counts “advertisers” who ask you to download something among the three most common ways channels get hacked, next to access the creator gave away and unchecked downloads and links. A fake offer usually shows itself in one of four places.

If you see one of these, don’t open anything yet.

• Check the brand on its own site. Find its partnerships contact there, or ask for a call before you reply, as YouTube advises creators.
• Ask for the brief as text. A real sponsor can paste it into the email or share a view-only Google Doc.
• Never run a file from an offer. If you need to look at one, open it in Google Drive preview on another device, not on the computer you manage the channel from.
• Sign in to Google only by typing the address yourself. Never sign in through a link in an email or on a deal page.
• Report the email as phishing in Gmail and delete it.

Fake emails “from YouTube” work the same way, often as a strike warning or a monetization notice. YouTube’s safety tips for creators say its real emails come only from @youtube.com or @google.com addresses and never ask for your password or account details. If an email says you got a strike, check YouTube Studio yourself instead of clicking the link.

Step 3: If you already opened the file

What to do depends on how far you got. In every case, secure your account from a different device, such as your phone or a second computer. Malware on the first one can copy a new password just as easily as the old one.

If the scan finds something, don’t trust that computer yet. AIR Media-Tech’s Safety team asks creators to run a full antivirus check and, in many cases, reinstall the operating system before they sign in on it again. Otherwise, the same malware can take the channel a second time.

For the next few days, keep an eye on YouTube Studio. Look for videos, live streams, or posts you didn’t make, a new channel name, or people under Permissions you didn’t add. Since October 21, 2026, YouTube may also pause uploads, live streams, and public posting on a channel it suspects was hacked while it reviews the case, usually for up to 24 hours. If you see that banner or have already lost access, follow our guide on what to do when your YouTube channel is hacked.

If your channel is already gone

Recovery always starts with the Google Account, because YouTube returns a channel only through the account it belongs to. After that comes YouTube’s hacked channel assistant. The full order of steps, the form, and what to check after recovery are in our guide on what to do when your YouTube channel is hacked. If YouTube removed the channel during the hack, read whether a deleted channel can be restored.

Hackers often upload videos that break the rules, and the channel gets strikes for them. Contact YouTube and explain that the activity happened during unauthorized access. When the hack is confirmed, AIR Media-Tech’s Safety team sees these strikes removed in almost every case, within a few days to a few weeks. Our guide to YouTube strikes explains how each one works.

Three channels our Safety team helped get back

Hack Protection gives a hacked channel a team that works with YouTube through partner support. Here’s how three recoveries went.

• A family channel with 14M+ subscribers. One of Heidi y Zidane’s channels was hacked. The team confirmed the owner’s identity, confirmed the case with YouTube support, and got access to the appeal restored by hand. The channel was back in a few days.
• A hack at 1 a.m. on December 31. A partner called the team in the middle of the night. The team confirmed the hijack with YouTube, and the creator reset the computer’s operating system as the team asked. The channel was back with its owner an hour and a half later. “The AIR team helped me regain access to my channel at 2 a.m. That, in my opinion, says it all,” the creator wrote afterwards.
• Brickmine, 237K+ subscribers. The Brickmine channel (now GoCraft Motion) lost access overnight. The team asked YouTube to verify the channel and restore access to the appeal form, then helped the creator write the appeal. The channel was back within a few days.

Your Next Step

Step 1 is a one-time setup, and Steps 2 and 3 are habits. If a hacker still gets in, AIR Media-Tech’s Safety team works on the case with you and with YouTube through partner support. Hack Protection is open to channels from 1,500 subscribers, including channels outside our network, and partners can reach the team straight from their dashboard.