Suspicious YouTube Activity

[u/Grand_Technician989]

Hey all, while I was sleeping- a video / livestream from around 2 to 3 hours ago ended up in my watch history. Upon clicking on it, the video is sitting at 1.2 million views, it’s unlisted and there’s comments of people saying they didn’t watch it. I’ve reported the video already and I’ve changed my password from my phone.

Is this some sort of YouTube exploit or is this someone using my cookies to view bot someone’s livestream? I’m unsure what to do right now, my PC is currently turned off and disconnected from the WiFi as I do that every night, should I run a virus scan or should I bite the bullet and go for a full reinstall? Please let me know because I don’t want to risk losing anything over something that isn’t something to worry about.

[u/larrylarro]

Idk too much about technology, but I entered those videos and recognized the streams, they always appear while I'm doomscrolling. You probably scrolled past one of those and forgot about it.

[u/Grand_Technician989 → u/larrylarro]

I see, I’ll keep an eye out

[u/Itafan → u/Grand_Technician989]

No, that's not possible. If they are unlisted, you couldn't have just scrolled past them.
Plus, you can clearly see from the red progress bar that the video was watched for 53 minutes straight. It’s definitely session hijacking or a fraudulent browser extension, as I doubt they managed to compromise YouTube itself.

[u/RetroDarlingSuccubus → u/Itafan]

If I'm not mistaken, the 53:54 is actually the total video length. The red progress bar is only a visual representation where in the video you last were and where in the video it will pick back up in.

So if OP watched for the full 53:54, the red bar would be at the end.

[u/Itafan → u/RetroDarlingSuccubus]

Yes, you're right.
looks like he only watched a third that is, 18 minutes, but it doesn't make much difference anyway.

[u/The_Mysterius_Szeg → u/RetroDarlingSuccubus]

Sometimes even you watched the the full thing the red bar defaults to quarter of the video, its insanely bad

[u/RetroDarlingSuccubus → u/The_Mysterius_Szeg]

Ah, either I must have never noticed or just barely paid it any attention. That's interesting though!

[u/The_Mysterius_Szeg → u/RetroDarlingSuccubus]

For me i often notice videos i watched all the way (on soneones channel i watch every video of his) just be on the quater of the video always

[u/Grand_Technician989 → u/Itafan]

Yeah, I’m going to run a malware scan later today when I get back home, I also have a feeling it could be one of my extensions so I’m going to remove them / scan through them too

[u/RoleBeginning5476 → u/Itafan]

sometimes videos that played by scrolling over them show a wacky time bar on the thumbnail but actually clicking them will just play the video from 0

[u/Leather-Chart7083 → u/Itafan]

Pretty improbable it's a session hijacker, but it could be a fraudulent browser extension. My explaination: Session Hijackers generally don't act instantly, they send the session cookie (Cookie logging) or a session token to an attacker, the attacker then decides if they want to import them or not, but if they do, they want to be stealthy, or the opposite, try to log you out but not watch a random YouTube video, it doesn't make sense. A malicious extension can send HTTP requests to the link with the browser's cookies, that can cause this behavior, though not pretty normal to do this but we aren't here to question the attacker.

The most realistic option is that when you are watching a livestream in the YouTube Shorts, what YouTube actually shows you is the specific minute, hour, or second when you came across it, and it marks it as if you watched the whole thing, when in reality you only encountered it at that specific moment.

[u/Itafan → u/Leather-Chart7083]

You're probably right, but there's another red flag: the channel is obviously inflated by bot viewers. Perhaps the people selling these fake views are using an extension to funnel in real users, Many people commenting on those videos claim not to have watched them, and honestly, that’s not something you usually see, the theory that they are compromised accounts is unlikely, but not impossible.

[u/Left-Command9158]

This happens if you scroll shorts. Even watching the live for a few seconds makes it appear on your history

[u/Grand_Technician989 → u/Left-Command9158]

Thing is, the live is unlisted and is currently sitting at a crazy amount of views.

[u/Satoru____Gojo → u/Grand_Technician989]

its a yt short livestream its normal to have alot of views over the span of the whole stream, and the live gets uploaded afterwards and gets unlisted its normal

[u/Aphellium → u/Satoru____Gojo]

Short

53 minutes

[u/Satoru____Gojo → u/Aphellium]

What?

i meant a Youtube Short, Livestream not a Short Youtube Stream

[u/Aphellium → u/Satoru____Gojo]

Never mind I thought you meant the video from the screenshot an you guys changed the topic to shorts, I'm fucking stupid, my bad.

[u/erd159]

You might have autoplay turned on; the stream played live while you were asleep, and now it’s been set to unlisted.

[u/Previous_Watch_1726]

Do you usually sleep with youtube on?

[u/Grand_Technician989 → u/Previous_Watch_1726]

Not at all, I sleep with my phone off and my PC turned off

[u/CynicalMexican]

I had something similar. Sometimes when browsing any websites they embed on the entire web page a redirect, so anywhere you click it opens a new window and plays a unlisted YouTube video. Most of the time the new window isn't overlayed onto your current browsing session and is underneath the your current window. Its a stupid redirect nothing more nothing less, I did malware scans as a precaution but nothing was detected, all good.

You can modify Firefox (if you are using it) to disable redirects and for it to not open a new window for redirects and at best open a new tab.

EDIT: To clarify this type of action is usually done to boost views on YouTube videos, its an unorthodox way to do it and it's highly despised. Usually done via deception on websites displaying ads.

[u/sheepiearts]

I'm super interested now this is weird asf to me

[u/RainnChild]

is there no good answer to this?

[u/Grand_Technician989 → u/RainnChild]

I have no clue, I’m quite confused on what to do. The comments are kinda mixed

[u/LethalLeviathan2 → u/RainnChild]

i have this issue for years and most the answers here are the same basically no fix

[u/Devobleed]

if you are in web, now by the view on hovering option it counts as a view on your history

[u/Noname99914]

This happened to me too

[u/Noname99914 → u/Noname99914]

I clicked on the stream and it is a stream i remember seeing while watching shorts

[u/Greatest-DOOT]

are you presumably using any sort of modified apk ? this could either be somehow reccomended while sleeping by the algorithms magic or your account got hijacked by some popular extension that might have had some kind of zero day exploit or something similar

[u/Grand_Technician989 → u/Greatest-DOOT]

Not at all, I used to but I use iOS now, I have been told to check my extensions though which I will be doing now that I’m home.

[u/Greatest-DOOT → u/Grand_Technician989]

do update asap if possible

[u/Grand_Technician989 → u/Greatest-DOOT]

I checked my extensions and I’m not sure if any of them are compromised but I’d assume not. I have AdBlock, Cookie Editor, uBlock Origin, Google Authenticator, Volume Master, SteamDB and CSFloat which are all showing no signs of being hacked

[u/WinnerVivid3443 → u/Greatest-DOOT]

Nah, I'm 99% sure those are just Live Shorts counting into the regular play history

[u/Mondai_May]

were you playing shorts before you went to sleep? sometimes, when shorts are autoplaying one to the next, it autoplays a livestream that is in the youtube shorts category.

sometimes sites with spam/popup ads redirect to a youtube video. this is not always noticed by the person visiting the site. but you would've had to be awake and be on a site with much spam/popup ads for it to be that specific thing (generally.)

it could be session stealing maybe, have you downloaded anything lately? have you done any captchas that required you to copy and paste or type anything at all?

maybe something else you watched, was originally one thing, but after getting a certain number of views was unlisted and changed to be this. I kind of doubt it's this one since it was a livestream BUT. I have seen this before, where channels that upload hours-long compilations of episodes of shows (for example, they upload 4 hours worth of Spongebob episodes, or any sort of American reality shows or such,) the content of course is copyrighted, and so they add maybe an hour worth of their own, original, unrelated content at the end of the video. sometimes after they get a certain number of views, they trim the video to remove all the copyrighted footage and leave only the unrelated, original content that they had inserted at the end. and also usually change the thumbnail and title so that it does not mention the copyrighted content anymore. this doesn't seem to be the situation here though.

[u/WinnerVivid3443 → u/Mondai_May]

I'm 99% sure it's just caused by live shorts counting into the regular play history even if you barely watch it

[u/Kultovbelial]

Had the same one. It was from a short I happened to come across. Live streaming guy playing jump rope game

[u/ratboysriseup]

i also got this and idk if i should be worried or not but it’s freaking me out

[u/Grand_Technician989 → u/ratboysriseup]

I’m sure we’ll be fine. As a safety precaution, check your browser extensions and your google account activity. People say it’s from shorts which I believe to be the cause now.

[u/ratboysriseup → u/Grand_Technician989]

yeah i definitely have gotten some random weird lives/shorts that i know are from my own mindless scrolling but it was just such a weird coincidence bc i don’t recall seeing this specific video either lol. it also showed up 2 or 3 times in my recent history. but also i understand how it’d be easy to miss. my only browser extensions are adguard, ublock, and malwarebytes, but i will still be taking a look when i have a chance.
edit: i did immediately check my activity/alerts and there was nothing new or weird and i also changed passwords anyway

[u/LethalLeviathan2]

i have this issue for years a tons of videos being watch not from me change password 7th time already i just gave up

[u/CG-Blight]

Just checked, I have that too.
When I'm watching shorts I come across like 1 stream per 15-20 videos. But for some reason there are a lot more records in history. Starting from one I do remember scrolling past are 3-5 streams I never interacted with. Doubt it's anything malicious, but it's annoying and shouldn't have been recorded in watch history.

[u/Grand_Technician989 → u/CG-Blight]

YouTube’s watch history system is annoyingly broken.

[u/AltruisticFoot948]

If its 3M users I think the problem is in youtube rather then the users including you but just to make sure, do the "change all passwords" stuff and move on.

[u/Prestigious-Limit-40]

doesn’t happen to me

[u/Leather-Chart7083]

You're safe, this is normal behavior while "doomscrolling"

[u/TyoBran]

You either downloaded macro or any automatic farm software for a game or you're really unlucky while browsing the internet

[u/WinnerVivid3443 → u/TyoBran]

Nah... It's just live shorts counting into the regular play history even if you barely watch it, they probably were Doom scrolling

[u/WinnerVivid3443]

Youtube is horrible and made it so the Live Shorts count into your regular history, even if you quickly scroll past them, it's really annoying

[u/nonemotionaI]

thats maybe a shorts live stream, u scrolling down but yt thinks u watch that