The primary hazard of this specific campaign is that it completely neutralizes standard Two-Factor Authentication (2FA) delivered over SMS. Many account owners believe that having 2-Step Verification active shields them from unauthorized access, assuming an attacker cannot log in without possessing the victim's physical handset.
Modern smishing operations bypass this barrier using Adversary-in-the-Middle frameworks like Evilginx or Modlishka. When a victim interacts with the fake code calculator, the attacker's server transparently negotiates the authentication handshake with Google in the background.
[Victim Device]
│
▼ (Submits password & OTP into fake "calculator")
[Attacker's AiTM Proxy Server]
│
▼ (Passes credentials directly to real authentication endpoint)
[Official Google Login API]
│
▼ (Validates login & returns authenticated session cookies)
[Attacker Captures Session Cookies] ──► Immediate Account Takeover
Once Google validates the legitimate one-time code forwarded by the proxy, it generates authenticated session tokens, known as session cookies (`SSID`, `SID`, and `HSID`). The reverse proxy intercepts these session cookies, writes them to the attacker's database, and drops the connection.
With those cookies imported into an automated browser instance, the criminal accesses the victim's YouTube channel without entering the password again. They can immediately change the channel's designated ownership role, overwrite the recovery phone number, wipe the original email, and rebrand the channel to promote fraudulent cryptocurrency streams.
