Fake Sponsorship Offers Steal YouTube Creators’ Google Accounts
Summary
Scammers impersonate brands to lure YouTube creators to fake collaboration sites, where Google credentials and verification codes can be stolen to take over accounts and channels. ESET advises independently verifying offers and securing accounts.
Key points
- Targeted emails impersonate brands including Hollyland, Nike and Spotify, and reference creators’ videos to make sponsorship offers seem genuine.
- Fake collaboration platforms use brand logos, campaign metrics and public channel data before prompting creators to sign in with Google.
- Entering a password and one-time verification code can give attackers access to Google services and YouTube channels; some victims have had recovery details and backup codes changed.
- ESET identified variants using names such as MATCHY and SCOUTY; similar reported attempts used TUBIVE and Creoventura.
- Verify offers through a brand’s independently located contact details, and scrutinize sender addresses and platform domains.
- Check that sign-in occurs on the provider’s own domain, review requested permissions, and use strong unique passwords with two-factor authentication or passkeys.
- If an account may be compromised, review Google Security Checkup, remove unrecognized access, change the password, and use account recovery if locked out.
Article Details
- Event Type
- Phishing campaign using fake brand sponsorship offers and collaboration platforms to steal Google account credentials.
- Impact
- Victims who provide their credentials and verification codes may lose access to Google services and YouTube channels. Attackers may change recovery details and backup codes, making account recovery more difficult.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | creoventura[.]com | Domain for the Creoventura agency associated with sponsorship offers that AndaSeat explicitly warned were not affiliated with it. |
| DOMAIN | joinmatchy[.]com | Domain reported by ESET as hosting the fake MATCHY collaboration platform used in the sponsorship scam. |
| DOMAIN | joinscouty[.]com | Domain reported by ESET as hosting the fake SCOUTY collaboration platform used in the sponsorship scam. |
| DOMAIN | matchyjoin[.]com | Domain reported by ESET as hosting the fake MATCHY collaboration platform used in the sponsorship scam. |
| DOMAIN | mytubive[.]com | Domain reported in connection with TUBIVE scam attempts targeting creators. |
Products
GoogleScammers are impersonating brands like Hollyland, Nike, Spotify, and Maono to lure YouTube creators into fake sponsorship deals that end with a fraudulent Google sign-in page.YouTubeScammers are impersonating brands like Hollyland, Nike, Spotify, and Maono to lure YouTube creators into fake sponsorship deals that end with a fraudulent Google sign-in page.