Hackers have turned YouTube into a spam channel by exploiting legitimate users invite feature. YouTube users have the facility to “Invite Your Friends”, which in effect allows them to send email to any address from their YouTube accounts.
This functionality is what the spammers are exploiting. The spam message is just like any “Invite Your Friends” message, except that it includes the typical spam content and links to spam Web sites. The messages all come from service@youtube.com.
"Spammers are doing this to defeat spam filters and to lower the recipient’s guard by making it look as though the messages are coming from a perfectly innocuous email address. YouTube’s own Help Centre suggests that you exclude the service@youtube.com email address from spam filtering. The spammers are keenly aware of this," said Bradley Anstis, Marshall’s director of product management.
Our advice is to avoid clicking on email links whenever you have doubts about the sender's identity. Even though YouTube support recommends to exclude service@youtube.com from the spam filters, we recommend you not to make this exception. After all, this is exactly what hackers are counting on.
