Fake Copyright Claims Sent Through LearnWorlds’ Mail System Target YouTube Channels

How the Scam Works

The email, from “Ann Hernandez LearnWorlds” at [email protected], is titled “Important Copyright Notification: LearnWorlds Content Usage Review”. It opens with “Dear Channel Owner” and says a “recent examination” found video parts that may use LearnWorlds graphics or interface elements without permission. It names no video, no timestamp and no channel, and asks for a prompt reply.

Hutchins noticed those gaps, and that it arrived on a Saturday morning. He also points out that YouTube has its own system for copyright claims, so a company would hardly need to email a channel owner about one.

The link in the email is a real YouTube address, youtube.com/redirect, with the scam site tucked inside it. Mail filters see youtube.com. When we opened it on 15 November, YouTube showed its own “Are you sure you want to leave YouTube?” page, naming copyright-policy.com as the destination.

From there, the scam runs in three steps:

1. A page with YouTube’s logo, Google’s footer links and the title “Verify Your YouTube Copyright Status” asks for your channel name or URL.
2. It then shows a copyright violation against that channel, which doesn’t exist.
3. A “verify your channel” button opens what looks like a Google sign-in window.

That window is part of the web page, not a real browser window. A reader who checked the site pointed this out under Hutchins’ post, and Hutchins agreed, adding that it is probably a live phishing proxy. The trick is known as browser-in-the-browser. With a proxy, the attackers can pass your password and your two-step code to Google as you type them. So an ordinary second factor such as a text message or an app code may not save the account.

The domain copyright-policy.com was registered on 14 November at 16:15 UTC, according to the public .com registry. The email’s own reference number carries the same date, with the time 20:47. The site was still online when we checked at 09:29 UTC on 15 November.

Was LearnWorlds Hacked?

We don’t know, and LearnWorlds hasn’t said.

What we checked: t.us1.learnworlds.com is a sending domain LearnWorlds runs through the email service Mailgun. Its public SPF record authorises Mailgun to send for it. So the message genuinely came out of LearnWorlds’ mail system, which is why spam filters let it through.

There are two ways that could happen. Someone may have broken into LearnWorlds or its Mailgun account, which is what Hutchins suspects. Or someone may have used the platform the way it is meant to be used. LearnWorlds’ help pages say email notifications from a school go out from a [email protected] address unless the school is on a higher plan and sends from its own domain. LearnWorlds also lets schools edit those notification texts, and it offers a 30-day free trial without a card.

If the second explanation is right, nothing was hacked, and you don’t need to be a LearnWorlds user to get the email. That is our reading of LearnWorlds’ documentation, not something LearnWorlds or Hutchins has confirmed. Either way, a course platform’s trusted sender name and domain end up working for the scammers. That matters more than the label.

Fake copyright notices are an old lure for YouTubers. Malwarebytes described a similar campaign in April 2026, run on a phishing kit that several gangs could rent. What is new here is the sender. “Check the sender’s domain” is the first thing every phishing guide teaches, and this one passes it.

How to Tell a Real Copyright Strike From This One

• Check YouTube Studio, not the email. Copyright strikes appear in YouTube Studio, under Content, with the Copyright filter and the Restrictions column. YouTube says it sends copyright strike emails only from [email protected]. An email from anyone else is a claim, not a strike, and you deal with it in Studio.
• Read the “leave YouTube” page. If a link from an email lands on YouTube’s “Are you sure you want to leave YouTube?” page, YouTube is telling you the destination isn’t YouTube. Close the tab.
• Try to drag the sign-in window. A real Google sign-in pop-up is a separate browser window and can be moved past the edge of the page. A fake one, drawn inside the page, gets stuck at the border or disappears when you minimise the page (Kaspersky’s explanation). On a phone, this test doesn’t work, which is one more reason not to sign in from an email link.
• Notice when your password manager stays quiet. It fills in your Google password on Google’s real sign-in page. If it offers nothing, the page probably isn’t Google’s.
• Use a passkey or a security key for the Google account behind your channel. A passkey only works on Google’s real site, and Google says it can’t be given to someone else by accident. A fake sign-in window can’t use it.

If You Already Signed In

Act at once, from a device you trust, and not through any link in the email.

1. Change the Google account password, then check Google’s Security Checkup at myaccount.google.com for unknown devices, recovery details and third-party apps with access. Remove anything you don’t recognise.
2. Sign out the other sessions and set up a passkey or security key.
3. In YouTube Studio, under Settings and then Permissions, check who can manage the channel and remove anyone you didn’t add. If others manage the channel with you, ask them to secure their accounts too.
4. If you have already lost access, follow YouTube’s hacked channel steps. YouTube says to recover the Google account first, then undo the hijackers’ changes quickly, because their uploads can bring strikes to your channel. Partner Program channels can also contact Creator Support once the account is back.
5. Report the email as phishing in your mail app. That helps the filters that this one slipped past.

We have asked LearnWorlds whether its systems were compromised and how the email was sent, and Google about the redirect link. We’ll update this article when they answer.