ESET Reveals Phishing Campaign Targeting YouTubers with Fake Sponsorship Offers
Scammers impersonate brands to trick creators into handing over Google account credentials via fake verification platforms.
Key points
- ESET researchers identified a campaign targeting YouTube creators with fake sponsorship emails.
- The fraud uses personalized content referencing specific videos to build trust.
- Victims are directed to a counterfeit platform to "verify" their channel, resulting in credential theft.
Security researchers at ESET have uncovered a sophisticated phishing campaign targeting YouTube content creators. The attack vector relies on social engineering, with fraudsters posing as legitimate brands seeking sponsorship partnerships to steal Google account credentials.
According to Help Net Security, the scheme is designed to mimic routine business interactions within the creator economy. Scammers send personalized emails that reference the recipient’s actual video content, creating a veneer of authenticity. The correspondence directs targeted creators to a convincing fake collaboration platform. The fraudsters guide victims through what appears to be a standard brand deal process. The critical moment occurs when the user is asked to sign in with their Google account to finalize the arrangement or verify their channel status. At this stage, the attacker captures the login credentials.
Campaign Mechanics and Impersonation
The campaign’s effectiveness stems from its high degree of personalization and the use of trusted brand identities. ESET researchers noted that one recent iteration of the attack impersonates Hollyland, a legitimate manufacturer. By leveraging the name of a real company, scammers lower the victim’s guard. The fake platform is constructed to look professional and similar to legitimate sponsorship management tools.
This visual similarity is crucial for the attack, as creators are accustomed to managing brand deals through third-party services. The prompt to "verify" the channel is a common tactic used to justify the request for login information, exploiting the creator’s desire to maintain account standing and secure revenue opportunities.
Who Is Affected
The primary targets of this campaign are YouTube creators who are actively seeking or open to brand sponsorship opportunities. Any creator with a public channel and published video content is potentially at risk, as scammers gather public information to craft their initial outreach. The attack specifically exploits the trust creators place in brand partners and the complexity of modern sponsorship workflows.
Because the initial contact appears to be a business opportunity rather than a malicious threat, victims may not suspect foul play until they have already entered their credentials. The compromise of a Google account can lead to further damage, including the theft of personal data, access to associated services, and potential misuse of the YouTube channel itself.
What should you do?
No patch or specific software update has been confirmed to address this social engineering attack, as it relies on user deception rather than a technical vulnerability in a product. Security professionals and creators should remain vigilant against unsolicited business offers. If a brand deal is initiated via email, verify the sender’s identity through independent channels before clicking any links. Be skeptical of requests to log in to external platforms using Google credentials for verification purposes.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: ESET
- Verify the authenticity of sponsorship offers by contacting the brand through official public channels, not the contact details provided in the email.
- Use multi-factor authentication on all Google accounts to add a layer of security even if credentials are compromised.
- Inspect the URL of any collaboration platform carefully before entering login information, looking for subtle misspellings or unfamiliar domains.
- Monitor account activity for unusual login attempts or changes to channel settings that could indicate unauthorized access.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which brand is being impersonated in this phishing campaign?
ESET researchers identified Hollyland, a legitimate manufacturer, as one of the brands being impersonated in recent attacks.
How do scammers convince creators to click the phishing links?
They send personalized emails referencing the creator's specific videos and pose as brands looking for sponsorship partners.
What is the ultimate goal of this phishing scheme?
The goal is to trick creators into signing in with their Google accounts on a fake platform, thereby stealing their login credentials.
