Scammers are targeting YouTube creators by posing as brands offering sponsorships and sending personalized emails that reference the creator’s videos. Victims are directed to a convincing fake collaboration platform and then prompted to sign in with Google, putting their accounts at risk.
This campaign targets YouTube content creators by impersonating brands offering sponsorship partnerships. The attackers send personalized emails that reference the creator's own videos, a detail designed to make the outreach feel authentic and tailored rather than mass-produced. Once a creator responds or clicks through, they are funneled to a fake collaboration platform built to resemble a legitimate brand partnership portal. The process mirrors a routine sponsorship negotiation right up until the final step, when the victim is prompted to sign in with their Google credentials to "continue" or "verify" the deal.
The effectiveness of this scheme comes down to personalization and sequencing. Referencing a creator's actual content gives the email a sense of social proof, implying the sender has genuinely watched their work and has a real reason to reach out. The fake platform itself is described as convincing, lowering suspicion before the credential request even appears. By placing the Google sign-in step at the very end of what looks like a normal brand deal workflow, the attackers exploit the momentum of the interaction. Creators are focused on evaluating a business opportunity, not scrutinizing a login prompt that seems like a routine verification step.
Because sponsorship outreach is a normal part of running a channel, this attack blends easily into everyday workflows for people in content and media roles, making it harder to dismiss outright.
Treat any unsolicited sponsorship outreach as high-risk, even when it accurately references your work, and verify the brand through known, official contact channels before clicking any links. Never enter Google credentials after following a link from an email; instead, navigate directly to Google or the platform in question using a bookmark or by typing the URL. Teams managing public-facing accounts, including creators and marketing staff, should be trained specifically to recognize convincing fake collaboration platforms designed to harvest login credentials, since the lure here depends on looking routine rather than obviously suspicious.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Scammers send personalized emails that reference a creator's own videos, posing as a brand offering a sponsorship deal, then direct victims to a fake collaboration platform that asks them to sign in with Google.
The emails reference the creator's actual videos, which builds trust and makes the outreach feel legitimate, and the flow mimics a routine brand partnership process right up until the credential request.
An unexpected request to sign in with Google credentials on a third-party collaboration site is the key warning sign, since legitimate sponsorship discussions should not require logging into your account on an external platform.
Content creators, social media managers, and marketing staff who manage brand or corporate Google accounts are the primary targets, since compromising those accounts can give attackers broad access.
You get an email: “Hi, we’re reaching out about a sponsorship opportunity after watching your videos.” Sounds flattering, right? Scammers are posing as brands, sending these personalized emails, then funneling you to a slick, fake collaboration platform that walks you through a “routine” brand deal. Here’s the trap: at the end, it prompts you to “Sign in with Google” to verify your channel. It looks normal, but you’re handing your Google login to a fake site that can hijack your YouTube. If a sponsorship email sends you to a site that wants your Google login, stop. Don’t sign in there, open YouTube or Google directly from your own bookmark and check any requests from there.
Scammers are targeting YouTube creators with personalized “sponsorship” emails that lead to a convincing fake collaboration website. The site pulls public channel data, then asks the creator to “Sign in with Google” to “verify” the channel, stealing the password and one-time code to take over Gmail…
A recent scam targets YouTube creators with personalized “paid collaboration” emails that impersonate well-known brands and push victims to a fake collaboration platform. The site then routes victims to a Google sign-in step that can capture credentials or trick users into granting dangerous…
Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
A phishing email posing as a ChatGPT billing notice pressures users to “update payment information” to avoid service interruption. The button routes through a Google redirect and lands on a fake OpenAI login page that captures usernames and passwords before sending victims to an error page.
