Skip to navigation

Threat reportPhishingTL-2026-5676

110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting

highMONITORING

ZeroFox disrupted a 110-domain phishing estate running a single kit that impersonated DMCA/YouTube copyright-strike notices to hijack content creators' Google accounts. The kit draws a fake browser-in-the-browser Google sign-in window, captures email, password, session cookie and second factor in real time, and cloaks itself behind per-victim tokens.

Key facts

IdentifiersTL-2026-5676
Also known asFake copyright-strike phishing estate, DMCA/YouTube copyright strike BitB phishing
SeverityHIGH
First disclosed
Affected productsGoogle Google Account / YouTube channels
Weaknesses (CWE)CWE-451, CWE-1021
MITRE ATT&CK techniquesT1036 Masquerading, T1056.003 Web Portal Capture, T1078.004 Cloud Accounts, T1090 Proxy, T1111 Multi-Factor Authentication Interception, T1204.001 Malicious Link, T1480 Execution Guardrails, T1539 Steal Web Session Cookie, T1566.002 Spearphishing Link, T1583.001 Domains, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorsnews - media, content creators, social media, entertainment
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5676 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fake Copyright-Strike BitB Phishing Estate - Lure Domain Family / Origin Access (Web Proxy)

Detects web-proxy requests to the 110-domain fake DMCA/YouTube copyright-strike phishing estate documented by ZeroFox (TL-2026-5676): known victim-link parents dmca-strike.com and dmca-desk.com, the dmca-*/strike*/takedown-*/ytchannel*/mediasync name families, and connections to the Cloudflare-bypassing origins 103.101.85.19 and 5.101.84.233. A hit means a user clicked a tokenized link that leads to the browser-in-the-browser Google sign-in page that captures password, session cookie and second factor in real time. Because the kit cloaks behind per-victim tokens and scores zero on URL-reputation tools, name-pattern and origin-IP matching is the reliable signal.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.002, T1204.001, T1583.001, T1656
  • Data sources: zscaler:nss:web (index=proxy), CommonSecurityLog (web proxy), Sigma logsource category: proxy
  • Severity: high
  • Confidence: high

Splunk SPL

index=proxy sourcetype="zscaler:nss:web" earliest=-24h
| rex field=url "^(?:https?://)?(?<lure_host>[^/:?#]+)"
| eval lure_host=lower(lure_host), dest_ip=coalesce(dest_ip,"")
| eval ioc_domain=if(match(lure_host,"(^|[.])(dmca-strike|dmca-desk)[.]com$"),1,0)
| eval ioc_origin=if(match(dest_ip,"^(103[.]101[.]85[.]19|5[.]101[.]84[.]233)$"),1,0)
| eval family_hit=if(match(lure_host,"dmca-|-dmca|dmcastrike|strike-?verify|strike-check|takedown-(help|alert|notification)|ytchannel(status|alerts)|mediaforsync|creatorsmediasync|mediasyncdigital"),1,0)
| where ioc_domain=1 OR ioc_origin=1 OR family_hit=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(lure_host) as lure_hosts values(dest_ip) as dest_ips sum(ioc_domain) as ioc_domain_hits sum(ioc_origin) as ioc_origin_hits by user src_ip
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let lure_family = @'dmca-|-dmca|dmcastrike|strike-?verify|strike-check|takedown-(help|alert|notification)|ytchannel(status|alerts)|mediaforsync|creatorsmediasync|mediasyncdigital';
let origin_ips = dynamic(['103.101.85.19','5.101.84.233']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL) or isnotempty(DestinationHostName)
| extend LureHost = tolower(iff(isnotempty(DestinationHostName), DestinationHostName, tostring(parse_url(RequestURL).Host)))
| where LureHost matches regex @'(^|[.])(dmca-strike|dmca-desk)[.]com$'
    or DestinationIP in (origin_ips)
    or LureHost matches regex lure_family
| project TimeGenerated, SourceIP, SourceUserName, LureHost, DestinationIP, RequestURL, DeviceAction

Sigma

title: Fake Copyright-Strike BitB Phishing - Lure Domain Family Access (TL-2026-5676)
id: 7c1d3b52-4e8a-4f0b-9a63-2d5e8f1a6b01
status: experimental
description: Detects proxy requests to the fake DMCA/YouTube copyright-strike phishing estate (browser-in-the-browser Google credential harvesting) by known victim-link parent domains and the dmca-*, strike*, takedown-*, ytchannel* and mediasync name families.
references:
  - https://www.zerofox.com/blog/how-we-disrupted-a-110-domain-fake-copyright-strike-phishing-estate
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.resource-development
  - attack.t1583.001
logsource:
  category: proxy
detection:
  selection_ioc:
    cs-host|endswith:
      - '.dmca-strike.com'
      - '.dmca-desk.com'
      - 'dmca-strike.com'
      - 'dmca-desk.com'
  selection_family:
    cs-host|contains:
      - 'dmca-'
      - '-dmca'
      - 'dmcastrike'
      - 'strikeverify'
      - 'strike-verify'
      - 'strike-check'
      - 'takedown-help'
      - 'takedown-alert'
      - 'takedown-notification'
      - 'ytchannelstatus'
      - 'ytchannelalerts'
  condition: 1 of selection_*
falsepositives:
  - Legitimate copyright-compliance or DMCA-agent vendor sites visited by legal or trust-and-safety staff
  - Security researchers and phishing-triage analysts opening reported links
level: high

Known false positives:

  • Legal / trust-and-safety staff visiting legitimate DMCA or copyright-agent vendor sites whose names contain dmca-
  • Security analysts opening reported phishing links during triage
  • Generic media-sync software vendors matching the mediasync stems

Tuning notes: Adjust index/sourcetype and the url/dest_ip field names to your proxy CIM mapping. Allow-list known DMCA vendors by exact registered domain. Do not close alerts on a clean URL-reputation score: the kit serves a benign decoy to scanners. Refresh the stem list from threat intel as new estate names appear (no new names seen after early October 2026).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Browser Process Connecting To Fake Copyright-Strike Phishing Estate (Endpoint) · unlock with TL Creds
  • Google Workspace Account Login From Multiple IPs Within 30 Minutes (Session Cookie Theft / Account Takeover) · unlock with TL Creds
  • Connections To Fake Copyright-Strike Phishing Origin Servers [indicator] and [indicator] · unlock with TL Creds
  • Tokenized Two-Character Subdomain Lure Links On Copyright-Strike Phishing Domains · unlock with TL Creds
  • Google Account Security Settings Changed After Phishing - Recovery / 2SV / Password Edit · unlock with TL Creds
  • Phishing Kit Anti-Analysis Scripts [indicator] / [indicator] Loaded From Web Page · unlock with TL Creds
  • Fake Copyright-Strike BitB Phishing - Credential Submission (HTTP POST) to Lure Estate · unlock with TL Creds
  • Fake Copyright-Strike Phishing Estate - DNS Resolution of Lure Domain Families · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5676.

Sample indicators (3 of 17)

  • IP address: 103.101.85[.]19
  • Domain: dmca-strike[.]com
  • IP address: 5.101.84[.]233

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

17 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

ZeroFox assesses the operator as Russian-speaking with moderate-to-high confidence.

ZeroFox (Carlos Alvarez, published 2026-11-10) documents an estate of 110 domains, registered from November 2025 to late September 2026, that all served one phishing kit. Victims receive a fake copyright strike or DMCA takedown notice, which ZeroFox calls close to the perfect lure for a creator. The tokenized link leads to a page titled "YouTube Copyright Strikes - Channel Status Check" that exists only to push the victim to sign in to Google.

The sign-in is a browser-in-the-browser (BitB) window drawn with HTML and CSS inside the page: a draggable fake popup with a title bar, a spoofed address bar showing accounts.google.com, and a padlock icon. Because the address bar is a graphic, URL-checking advice does not protect the victim. The kit captures the email address, password, session cookie and second factor in real time, so one-time-code MFA does not stop it. The documented end state is a hijacked channel that is renamed and used for cryptocurrency-scam livestreams.

The kit cloaks aggressively. Scanners and visitors without a valid per-victim token get a benign page (a generic account-status page, "Maintenance Underway", or a fake "Northwind Studio - Independent design & engineering" site). The fake Google window renders only for the victim who clicked the tokenized link. Brand imagery is drawn so content-based classifiers do not flag it, and the scripts console-ban and context-menu-ban block the developer console and right-click inspection. URL reputation tools returned a score of zero with no brand detection, which ZeroFox describes as false negatives.

Infrastructure: Cloudflare fronts all live front-ends. Origin 103.101.85.19 (Russian-registered range leased through an address broker, Linux, nginx 1.18.0, ports 22/80/443/8080) co-hosted confirmed estate members, the mediasync cluster and the ID-number names. Origin 5.101.84.233 (Petersburg Internet Network) hosted one estate member alongside Russian movie-piracy sites. NiceNIC International sponsored 52 of the 110 names; other registrars were Namecheap, Global Domain Group, Dynadot, PDR, CNOBIN, Dominet HK and Hello Internet. TLDs include .info, .cfd, .click, .sbs, .ink and .shop. Victim links use random two-character subdomain labels (for example 4x.dmca-strike.com and ye.dmca-desk.com).

Status at publication: 82 domains suspended by registrars or registries, 17 return Cloudflare HTTP 523, 6 show Cloudflare's Suspected Phishing interstitial, 1 Blogger-hosted page returns Blog not found, and 1 name stopped reaching a working origin in early November without a registrar hold, so the operator may still control it. None of the 28 remaining names serve the lure. No new names were seen after early October 2026. The same kit structure was also seen on a PayPal-themed page and a Russian-language casino login page, so the credential capture is reusable.

Attribution: ZeroFox assesses a Russian-speaking operator at moderate-to-high confidence, based on hosting in Russian ranges, hard-coded Russian interface strings, and page titles using Cyrillic characters that resemble Latin letters. The ZeroFox article does not name the exfiltration channel or a collection endpoint and publishes no file hashes or URL paths. Related but separately documented copyright-strike BitB kits (Malwarebytes, 2026-04-15; urlscan.io GSVerify/Knock, 2026-08-17) share the lure and technique and also show Russian-language artifacts, but ZeroFox does not link its estate to them, so their indicators are not included here.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1480 Execution Guardrails; T1684.001 Impersonation

Credential Access

T1056.003 Web Portal Capture; T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie

Persistence

T1078.004 Cloud Accounts

Command and Control

T1090 Proxy

Execution

T1204.001 Malicious Link

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains

Impact

T1657 Financial Theft

Remediation

Immediate actions

  • Load the domain naming families (dmca-*, *-dmca, strike*, takedown-*, ytchannelstatus, ytchannelalerts, mediasync, sweep/sweeply, ID and payment patterns) into hunting and email/web filtering rules
  • Block origins 103.101.85.19 and 5.101.84.233 where origin traffic is visible
  • Do not close tickets on a reputation score of zero; cloaked pages are built to look clean to scanners
  • If credentials were entered: reset the Google password, revoke all active sessions and check the channel for unauthorized renames or livestreams
  • Monitor the one estate name not under registrar hold for re-pointing to new hosting

Workarounds

  • Check strike status only inside YouTube Studio, never through links in messages
  • Treat a sign-in window inside a web page as suspect: a real popup can be dragged outside the page and shows the real address bar

Longer-term hardening

  • Enforce phishing-resistant MFA (passkeys or hardware security keys) for creator and brand accounts
  • Use historical DNS resolution data to find shared origins hidden behind Cloudflare
  • Train creators that any notice asking them to sign in elsewhere to resolve a copyright strike is hostile; go to the platform directly in a new tab

Affected and fixed versions

  • Google — Google Account / YouTube channels
    Vulnerable versions: Accounts protected only by passwords or one-time-code MFA
    Fixed in: Accounts protected by passkeys or hardware security keys

Timeline

  • Earliest domains of the 110-domain estate registered (November 2025; exact day not stated by ZeroFox)
  • Malwarebytes publishes a separate fake YouTube copyright-notice BitB phishing kit analysis (related technique; not linked to this estate by ZeroFox)
  • urlscan.io publishes GSVerify and Knock copyright-strike BitB clusters (related technique; not linked to this estate by ZeroFox)
  • Latest estate domains registered in late September 2026 (approximate date)
  • No new estate names observed since early October 2026 (approximate date)
  • One name stops reaching a working origin in early November without a registrar hold; operator may still control it (approximate date)
  • ZeroFox publishes disruption report: 82 of 110 domains suspended, 17 return HTTP 523, 6 show Cloudflare Suspected Phishing interstitial, 1 Blogger page not found; none of the 28 remaining serve the lure

Sources cited

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats