Fake Brand Deals Steal YouTube Creator Accounts

Scammers are targeting YouTube creators with personalized “sponsorship” emails that lead to a convincing fake collaboration website. The site pulls public channel data, then asks the creator to “Sign in with Google” to “verify” the channel, stealing the password and one-time code to take over Gmail and the YouTube channel.

Key findings

• Attackers pose as well-known brands offering sponsorships and send personalized emails referencing the creator’s own videos.
• Victims are directed to a polished fake “collaboration platform” that shows metrics, logos, and an earnings calculator, and pulls public channel data to appear legitimate.
• The scam culminates in a fake or abused Google sign-in step framed as “channel verification,” capturing the password and one-time verification code.
• ESET observed changing platform names/domains (MATCHY/SCOUTY/TUBIVE) indicating a repeatable, modular campaign.
• At least one victim reported attackers changing recovery options and generating new backup codes to lock the owner out.

Who’s being targeted

• Commonly targeted roles: YouTube creators, Influencer/creator partnerships teams, Social media managers, Marketing teams, Executive assistants supporting public-facing accounts.
• Affected industries: Media and content creation, Influencer marketing, Social media creators.
• Attack channels: email, website.
• Impersonated: A legitimate brand (e.g., Hollyland / Nike / Spotify) and its ‘collaboration platform’, A ‘Sign in with Google’ verification flow on a fake sponsorship platform, A sponsorship ‘agency’ (e.g., ‘Creoventura’) claiming brand partnerships.

Awareness takeaways

• Independently verify sponsorship offers using official brand contact info, don’t reply to the email or use its links.
• Treat polished ‘collaboration platforms’ as untrusted until you verify the domain and who owns/operates it.
• Be extra cautious with ‘Sign in with Google’ (or other SSO) prompts; confirm the login page is on the real provider domain before entering credentials or codes.
• If you suspect compromise, act quickly: review recent logins/devices, recovery info, and third-party access; then reset credentials and strengthen MFA/passkeys.

Red flags to watch for

• Sender email address is not from the real brand’s domain
• Brand-new or throwaway-looking domains for the ‘collaboration platform’ (e.g., MATCHY/SCOUTY/TUBIVE)
• The site uses familiar logos and metrics but ultimately pushes you to sign in and provide a one-time code
• Unexpected request to provide a one-time code to a third-party site
• SSO sign-in prompt not clearly on the provider’s real domain
• Overly polished site that doesn’t withstand deeper checks (links, company details, ownership)
• Brand publicly denies affiliation with the agency
• Company identity details don’t match official registers
• Social icons link to generic platform homepages instead of real profiles