TLDR
A new phishing campaign is targeting YouTubers and content creators with fake sponsorship offers from well known brands such as Hollyland. The scam begins with a personalized email referencing the creator's actual videos, then funnels the...
How it works
A new phishing campaign is targeting YouTubers and content creators with fake sponsorship offers from well known brands such as Hollyland. The scam begins with a personalized email referencing the creator's actual videos, then funnels the...
Red flags
- The sender's email domain does not match the brand's official website domain. The "collaboration platform" lives on an unrelated third party domain rather than the real brand's site. A Google sign in page is requested from an unfamiliar site, especially one asking for permissions to manage your YouTube channel
What to do
- 1Verify any sponsorship pitch by navigating directly to the brand's official website and contacting their partnerships team through known channels. Never click "Sign in with Google" links embedded in third party sites
- 2instead open google.com manually and review the app/permissions list under your account. Use a unique password and har
Source
welivesecurity
Source reviewed by Mythos Forensic Team
https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/FAQ
Is Brand deal phishing scam impersonates sponsors to steal YouTube creators' Google accounts a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
The sender's email domain does not match the brand's official website domain. The "collaboration platform" lives on an unrelated third party domain rather than the real brand's site. A Google sign in page is requested from an unfamiliar site, especially one asking for permissions to manage your YouTube channel
What should I do first?
Verify any sponsorship pitch by navigating directly to the brand's official website and contacting their partnerships team through known channels. Never click "Sign in with Google" links embedded in third party sites; instead open google.com manually and review the app/permissions list under your account. Use a unique password and har
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.