Platform Watch

Hijacked Channels Are Now Running AI Deepfake Livestreams

Cardano's IOG warned users away from its own YouTube channel after a hijacker streamed an AI-manipulated giveaway. Hijacked creator channels have become the vehicle of choice for deepfake fraud.

4 min read · Published 18 September 2026

What happened

On 18 September 2026, Input Output Group — the company behind the Cardano blockchain — warned its audience to avoid the organisation's own YouTube channel after an apparent takeover. The channel was carrying a livestream presented as a Project Catalyst town hall, using footage resembling founder Charles Hoskinson, promoting an offer that claimed viewers could 'double your wealth' by following a QR code to payments.

The broadcast used recognisable Project Catalyst branding, and no evidence suggested Hoskinson or the project authorised it. The suspicious livestream remained online for close to two hours before the warning went out. Cardano's ecosystem has documented similar YouTube giveaway scams for years — including hijacked channels impersonating ecosystem leaders.

Why hijacked creator channels

A hijacked channel is not just an asset — it is pre-packaged trust. The subscriber base is real, the notification bell still works, and the audience has years of reasons to believe what appears on the channel. AI-manipulated video removes the last checkpoint most viewers rely on: 'I saw the founder's face, it must be real.'

The scale is not anecdotal. Bitdefender Labs' analysis of attacks on content creators across 2024 detected more than 9,000 malicious livestreams on YouTube alone, with a single compromised account reaching 28.1 million subscribers.

The reputational ricochet

When a channel is used to defraud its own audience, recovery is no longer just a technical exercise. Viewers who lost money — or who watched it happen — associate the loss with the creator, not the attacker. Sponsors read the same headlines. The remediation cost is as much reputational as forensic, which is precisely the cost standard cyber policies were never designed to carry.

The takeaway

For creators, the lesson is uncomfortable but useful: your channel's trust is the attackers' product. Guard the account like the revenue-bearing asset it is — hardware keys, audited admin access, verified second channels for any 'urgent' brand or platform contact. And price the tail risk honestly: if your channel ran a scam livestream tomorrow, what would it cost to make your audience whole? That number is what the cover conversation is about.

✓ Verified sources

2 sources · 3 claims

Every third-party claim used in this briefing

  • Input Output Group warned users to avoid its YouTube channel on 18 September 2026 after an apparent hijack streamed a suspected AI-manipulated giveaway claiming viewers could 'double your wealth'.

    [1] crypto.news · Sep 2026 ↗
  • The suspicious livestream used Project Catalyst branding and a QR code directing users toward payments, and remained online for close to two hours.

    [1] crypto.news · Sep 2026 ↗
  • Bitdefender Labs detected more than 9,000 malicious livestreams on YouTube during its 2024 analysis of attacks on content creators.

    [2] Bitdefender Labs · Apr 2025 ↗

Source list

  1. [1]
    Cardano's IOG warns users after YouTube channel hijack
    crypto.news · Published Sep 2026 · Verified 18 Sept 2026
  2. [2]
    Account takeover attacks on social media: a rising threat for content creators and influencers
    Bitdefender Labs · Published Apr 2025 · Verified 18 Sept 2026

Every figure in this briefing is attributable to a named third-party publication above. GMG will publish its own anonymised, aggregated claims data once it is statistically meaningful.