Brand Deal Scam Hijacks YouTube Creators’ Google Accounts
A brand deal scam targeting YouTube creators uses fake sponsorship offers to compromise Google accounts. Operators send personalized emails mimicking corporate creator-partnership teams. These messages reference recent videos published by the target and propose device reviews or long-term paid collaborations.
Initial contact originates from domains that do not match official corporate infrastructure. When targets reply with rate cards, senders direct them to fabricated portals such as joinmatchy.com/hollyland. These portals render campaign metrics, major brand logos, and revenue calculators that ingest the creator channel URL to generate tailored interfaces.
Creators input their channel URLs into the portal, which redirects them to a credential harvesting interface designed to mimic Google sign-in pages. The interface collects user passwords and multi-factor authentication codes. Because the phishing domain mimics the corporate name, targets proceed without immediate suspicion.
Attackers establish trust through multi-step interaction rather than immediate credential requests. The harvesting interface captures authentication tokens, granting operators access to Gmail, Google Drive, and associated services. In documented incidents, operators replaced recovery phone numbers and email addresses with attacker-controlled parameters, deployed backup codes, and blocked account recovery attempts.
The campaign operates on modular infrastructure. Operators deploy multiple brand names including Hollyland, Nike, and Spotify alongside various domains containing strings like Scouty. Underlying source code, favicons, and metadata remain consistent across variants. This structure indicates a reusable phishing framework that operators adapt rapidly for subsequent campaigns.
Mechanics of the Brand Deal Scam
Security analysts identified specific technical indicators during investigations into the campaign. Operators harvest public channel data to populate phishing emails with accurate context. Senders rely on lookalike domains that bypass casual inspection. The intermediary portals ingest channel analytics to maintain the illusion of legitimacy before routing traffic to credential capture endpoints.
When targets enter authentication credentials, the infrastructure records the data and passes requests to legitimate services or displays error messages to mask the theft. This keeps targets engaged while operators complete session hijacking and modify account recovery parameters. The reliance on standard OAuth flows or proxy pages reduces the visibility of the compromise.
Attack Path Overview
- Senders dispatch personalized emails from spoofed corporate domains referencing specific channel content.
- Targets follow links to a fake collaboration platform that collects channel URLs and displays customized metrics.
- The platform redirects to a credential harvesting page that captures passwords and one-time authentication codes.
- Operators achieve account takeover and modify recovery options to prevent legitimate access.
Evidence and Attribution
- Emails reference specific videos from target channels, confirming the operators inspect public YouTube data before contact.
- Domain names utilized in the outreach do not resolve to official corporate infrastructure.
- Phishing platforms display consistent source code and favicons across different brand impersonation variants.
- Incident reports confirm that unauthorized actors modified recovery phone numbers and email addresses immediately following the compromise.
Mitigation Steps for Creators and Organizations
- Verify sender domains against official corporate registry records before responding to collaboration offers.
- Avoid clicking links in unsolicited sponsorship emails and navigate directly to official brand websites via known channels.
- Enable robust multi-factor authentication on Google accounts, prioritizing hardware security keys over SMS-based codes.
- Review connected third-party applications in Google account settings and revoke unauthorized access permissions.
- Monitor recovery options continuously to ensure phone numbers and backup emails remain under legitimate administrative control.
- Train internal staff and creators to recognize multi-step social engineering workflows that bypass standard security filters.
What to Watch For
- Operators continue to deploy new variants utilizing alternative brand names and newly registered domains.
- Infrastructure pivots may expand the targeting funnel toward other social media platforms leveraging centralized identity providers.
- The integration of authentic authentication proxies increases the probability of successful credential capture among targeted professionals.
Related coverage
- Threat Actors Abuse the Action1 RMM Tool via Phishing Campaigns
- Microsoft Twitter Account Hijacked for Crypto Scam Featuring Clippy
- Russian Threat Actor UAC-0099 Refines MatchBoil Malware Against Ukrainian Targets