This article walks through a common social media phishing trick: a friendly-sounding request to vote in a fake Spotify and Google podcast contest, the subtle domain giveaway, how the scam harvests logins and spreads, and practical steps you can take right away to protect accounts and break the chain.
It began with what looked like a harmless favor from a friend, a short message that felt personal and urgent. “Hey, I need a quick favor,” the message read. The tone made the ask feel normal and friendly, until one tiny detail stood out and changed everything.
“Please vote for me, I would really appreciate it as the voting will be ending today.” That follow-up line cranked up the pressure and pushed toward a quick click. A final prompt added, “Thanks, please send me a screenshot after you voted.”
That push for a screenshot and immediate action is a major red flag. The link led to a domain that read spotifyprime-hub.ct.ws, which is not spotify.com. Scammers favor cheap lookalike domains because they are easy to set up and hard to notice in a fast scroll.
The site itself looked tidy and official, even claiming Google involvement, and it immediately asked visitors to sign in. That is the trick: polished design hides a credential-harvesting form that asks for unrelated platform logins. The setup is designed to bypass suspicion and capture usernames and passwords.
“So I got that Twitter DM from a friend last week. I signed in to vote for him. It didn’t work.”
“Then, a day later, they hacked my account and locked me out before I could change my password. I am still locked out, and it is apparently doing it to other people.”
“Another friend got it from me and also got hacked and is locked out. They are trying to extort him to get access back. And today they tried to get into my bank accounts. It has been miserable.”
That string of events shows how fast account takeovers spread: one compromised login becomes dozens, then hundreds, as attackers push the same bait through your contacts. The scam depends on speed, reuse of passwords, and social trust inside networks.
The playbook is straightforward. Step one: you enter credentials on the fake page. Step two: the scammer uses those credentials immediately, changes recovery options, and locks you out. Step three: they send the same voting message to everyone in your list. If you reuse passwords, they try those credentials on email, banking, and shopping sites next.
Screenshots play a role too. After you “vote,” being asked for proof confirms you completed the login and may reveal usernames or other visible details. That request also keeps you interacting long enough so the account takeover can complete without immediate detection.
“We’re aware of phishing messages falsely claiming to be associated with Spotify and other brands,” “These messages are not from Spotify, are not connected to any official Spotify event or activity, and are not occurring on the Spotify platform. We encourage people to remain vigilant and avoid clicking on suspicious links.”
A Google spokesperson also emphasized the importance of spotting scams and using official guidance to stay safe. No legitimate company runs voting on random third-party domains, and official help pages will always point you to verified processes rather than asking for unrelated account logins.
Prevention is simple and practical. Stop and inspect the domain before you click; if it is not the company’s official domain, do not proceed. Remember that urgency and emotional pressure are classic scam tools—real friends can wait for a normal message or a verified link.
Use app-based two-factor authentication wherever possible to add a strong barrier against attackers, and rely on a password manager to generate and store unique passwords for each site. Strong antivirus software can block known phishing pages and warn you before you visit a malicious site, adding another layer of protection.
If you receive a suspicious ask from someone you know, call or text them via a separate channel to confirm it was really them. Check active sessions on social platforms regularly and log out of unfamiliar devices immediately, because time matters when an account takeover is underway.
There is no legitimate Spotify and Google podcast voting event running on a random ct.ws domain; the whole operation is built to steal credentials, hijack accounts, and spread. Pause before clicking, inspect the link, and that small moment of skepticism can prevent the hassle and harm of an account takeover.
