Recover and clean a hijacked YouTube channel in the right order

A hijacked channel may suddenly show scam livestreams, changed branding, unknown managers or an altered AdSense association. YouTube states that every channel is tied to a Google Account and that recovering that account comes first. Cleaning uploads while the attacker still controls a Google session can be undone immediately. The job is containment, recovery, channel repair and then evidence-based verification.

Before you start​

Use a trusted device and open Google's recovery or security pages directly. Save URLs and screenshots of suspicious streams, messages and setting changes. Warn viewers through another verified channel if active scams are being broadcast. Avoid third-party 'channel recovery agents' who ask for passwords, codes or payment.

Do it step by step​

1. Recover the affected Google Account using Google's official account-recovery flow. Change its password, review recovery email and phone, inspect recent security activity and sign out unfamiliar devices. Check connected apps and passkeys as well as passwords.
2. Scan the device used to manage the channel for malware, especially if a recent sponsorship file was opened. YouTube warns that malware can steal session cookies, so a password change on the same compromised device may be insufficient.
3. Open YouTube Studio. If the hacked-channel cleanup tool is available to your role, review the unusual changes it lists. Confirm each proposed correction; do not apply a blanket reversal to legitimate work made by teammates.
4. Inspect uploads, streams, playlists, thumbnails, channel name, description, links and permissions manually. Remove unknown users and unauthorized material following YouTube's guidance. Also inspect AdSense for YouTube and Content Manager settings where applicable.
5. Review strikes, claims and alerts before deleting attacker uploads. YouTube notes that videos with associated strikes or claims require different handling; follow the platform's cleanup advice rather than assuming deletion resolves a strike.
6. Rebuild defenses: set a passkey or strong two-step verification, update recovery options, remove unnecessary managers and use channel permissions instead of shared credentials. Ask an eligible creator-support team for help if account recovery succeeded but channel cleanup remains blocked.

Check the result​

The Google Account is secure, unauthorized channel activity and permissions are removed or under a documented support case, and viewers no longer see attacker-controlled material from the channel.

If something goes wrong​

If you cannot regain the Google Account, focus on Google's recovery flow before Studio. If cleanup reports an item you recognize, inspect the change and do not reverse it blindly. If a scam stream remains live, use official support and report channels while continuing containment.

Know the limit​

YouTube's cleanup tool is limited to owners and managers and may not identify every bad change. Deleting a video does not automatically clear a strike, payment issue or data already copied by an intruder. Treat financial or sponsor-account exposure as a separate incident. YouTube hacked-channel recovery YouTube cleanup guide