Fake Sponsorship Deals Are Phishing YouTube Creators Out of Their Google Accounts
A brand deal scam negotiates rates by email, then sends creators to a fake collaboration platform and a Google sign-in that captures the password and one-time code.
AegisAI Threat IntelligenceAegisAI Threat Watch · Creator account takeover
Fake Sponsorship Deals Are Phishing YouTube Creators Out of Their Google Accounts
A brand deal scam negotiates rates by email, then sends creators to a fake collaboration platform and a Google sign-in that captures the password and one-time code.
Analysis based on ESET research, 7 Oct 2026.
A brand deal scam is taking over YouTube creators' Google accounts by running a sponsorship negotiation first and asking for a sign-in last. According to ESET, the sender poses as a creator-partnerships contact at Hollyland, a maker of wireless audio and video gear, and agrees rates over email before pointing the creator to a fake collaboration platform.
The platform pulls public details from the creator's own channel, then asks for a Google sign-in presented as channel verification. The page captures the password and the one-time code, and ESET describes a victim whose phone number and recovery email were replaced within the account. The same kit has appeared under at least three brand names, and the operators have changed names and domains repeatedly since June.
Sources: ESET, 7 Oct 2026; Help Net Security, 8 Oct 2026, for the SCOUTY and TUBIVE names.
Key judgments
- The scheme delays every risky step. Early messages carry no link or file, so the first emails give a filter and a recipient little to object to. The credential request comes only after trust is built.
- The theft is framed as a routine action. A Google sign-in presented as channel verification mirrors something creators legitimately do, which is why polished design and familiar logos carry so much of the deception.
- The kit is reused, not rebuilt. ESET describes the same functionality and code under different brand identities, with domains and names changed repeatedly between June and August, so a single domain blocklist ages quickly.
- The loss is wider than one login. A taken-over account exposes linked Google services and the channel's standing with followers and collaborators, and replaced recovery details slow the owner's return.
The scheme earns trust before it asks for anything
A brand offer, then a rate negotiation
ESET's walkthrough follows a journalist who was contacted by a sender claiming to represent Hollyland creator partnerships. The conversation covered rates over several emails with no link in it. Near-identical variants use Nike and Spotify as the sponsor, according to ESET, so the brand is a swappable costume rather than a fixed part of the scheme.
The tell that ESET and Help Net Security both point to is the sender address, which has nothing to do with the brand being impersonated. In a routine business exchange that detail is easy to skip.
A collaboration platform that looks established
Only after the rates are agreed does the sender share a link. Help Net Security describes the destination as an influencer marketing platform with campaign metrics, large brand logos, an earnings calculator and tools for contracts and payments. The page pulls public data from the creator's own channel, which makes it feel built for the recipient.
The final step is a Google sign-in presented as a way to verify channel ownership. ESET reports that entering the password and the one-time verification code gives the operators the account, including the services linked to it such as Gmail and Google Drive, and control of the channel.
What the creator sees, and what the scheme is doing
Every step on the first lane is ordinary. The second lane is the one that matters.
What the creator experiences
A normal sponsorship deal
What the scheme is doing
One credential request, saved for last
Sources: ESET, 7 Oct 2026; Help Net Security, 8 Oct 2026.
One kit has been renamed at least three times
ESET found the platform under the name MATCHY, on joinmatchy[.]com and matchyjoin[.]com, and describes it as modular: the same functionality and code reused with a new bogus identity. Help Net Security adds two more names from other reports. SCOUTY appears on joinscouty[.]com, and TUBIVE, taken from a Reddit report of scam attempts, appears on mytubive[.]com. Help Net Security also attributes shared favicons and meta descriptions to ESET's findings; that detail is not in the ESET text reviewed here.
ESET observed names and domains changing repeatedly between June and August. For defenders the practical reading is that the brand name is not the stable part. The stable parts are the sequence (offer, negotiation, platform, sign-in) and the request at the end.
A damaged account is hard to win back
ESET describes one victim whose attackers replaced the account's phone number and recovery email and added their own backup codes. Those are the three recovery routes an owner would normally use, so the takeover is built to last. ESET also lists what a compromised account can be used for: reaching other linked services, impersonating the creator to followers or collaborators, and spreading further scams.
For an organization, the exposure depends on what the account is tied to. A brand or agency channel that sits next to a work Google account carries that account's access with it.
A related fake agency, with a limit on what is known
Help Net Security describes a separate case in which gaming-furniture brand AndaSeat said it has no affiliation with an agency called Creoventura, at creoventura[.]com. According to that report, the company name on the site is spelled differently from the UK register entry, its listed business activities are unrelated to influencer marketing, and the domain was registered through Namecheap in August 2026 for one year with hidden ownership. Whether this agency belongs to the same operation as MATCHY is not reported.
The sponsorship is the lure. The sign-in is the theft. Everything before it exists to make that one request look routine.
AegisAI Threat IntelligenceWhy standard controls miss it
The early messages contain nothing to scan. They are a brand introduction and a rate discussion, with no attachment and no link, so a control that judges each message in isolation sees ordinary business email. The risk sits in the direction of the conversation, not in any single line of it.
The destination is built to survive a quick look. ESET notes that professional design and familiar logos do not make a site legitimate, and the closing request, signing in with Google, is something real creator tools ask for. A page that copies a normal action is harder to flag than one that asks for something odd.
How Aegis protects against it
The outreach in ESET's walkthrough arrived by email, and the link to the platform follows in the same conversation. That is the stage an email defense can act on. The delivery channel for other creators who were approached has not been reported.
AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message. More on how that works: inbound email security.
Sign-ins that happen after a click on a third-party page are outside what an email control sees; the recommendations below cover that stage.
Related: account takeover protection.
What the reporting does not tell us
Scale. ESET does not say how many creators were approached or how many accounts were taken over.
Delivery. Beyond the walkthrough, the sending infrastructure for the first message is not described, and the Reddit-sourced TUBIVE reports have no ESET confirmation.
Duration. No source gives how long a typical negotiation runs before the link arrives.
Links between cases. A connection between MATCHY and the Creoventura agency has not been shown.
MITRE ATT&CK mapping
| ID | Name | Use in this campaign |
|---|---|---|
T1656 | Impersonation | The sender poses as a creator-partnerships contact at a real brand such as Hollyland, Nike or Spotify. |
T1566.002 | Phishing: Spearphishing Link | A link to the fake collaboration platform arrives after the rate negotiation. |
T1598.003 | Phishing for Information: Spearphishing Link | The fake Google sign-in, presented as channel verification, collects the password and one-time code. |
T1098 | Account Manipulation | The attackers replace the phone number and recovery email and add backup codes to hold the account. |
Indicators of compromise
| Indicator | Type | Note |
|---|---|---|
joinmatchy[.]com | Domain | MATCHY collaboration platform (ESET). |
matchyjoin[.]com | Domain | MATCHY collaboration platform (ESET). |
joinscouty[.]com | Domain | SCOUTY variant (Help Net Security). |
mytubive[.]com | Domain | TUBIVE variant, from a Reddit report (Help Net Security); unconfirmed by ESET. |
creoventura[.]com | Domain | Agency AndaSeat said it has no affiliation with; link to MATCHY not shown (Help Net Security). |
Infrastructure changes quickly. Treat these as historical indicators, not a live blocklist. Domains are defanged with [.].
Recommendations for defenders
- Verify sponsorship offers outside the thread. ESET advises looking up the brand's official contact details independently instead of replying or using any contact the message supplies. For teams that manage channels, make that a written step before any rate discussion.
- Move channel and brand accounts to phishing-resistant sign-in. ESET recommends strong, unique passwords with two-factor authentication or passkeys. A one-time code can be relayed by a fake page, as in this campaign, while a passkey is bound to the real provider domain.
- Set one rule for single sign-on prompts. Confirm the page sits on the provider's own domain, such as accounts.google.com, before entering anything, and review the permissions list before authorizing any app. A site that only needs to verify a channel has no reason to ask to manage it.
- Watch for recovery changes. Replaced phone numbers, replaced recovery emails and newly generated backup codes are the signature of this takeover. Alert on them where the account is managed, and treat them as a response trigger.
- Prepare the recovery steps before they are needed. ESET's guidance for a suspected compromise is to run Google's Security Checkup and remove unrecognized devices, recovery information and third-party connections.
FAQ
How does the YouTube sponsorship phishing scam work?
A sender posing as a brand such as Hollyland negotiates a paid sponsorship over email with no link involved, then shares a link to a fake collaboration platform. The platform uses public channel data to look personal and asks for a Google sign-in presented as channel verification, which captures the password and one-time code, according to ESET.
Which brands are impersonated in these offers?
ESET names Hollyland as the main brand, with near-identical variants using Nike and Spotify. Help Net Security separately reports an agency called Creoventura that AndaSeat said it has no affiliation with.
What are MATCHY, SCOUTY and TUBIVE?
They are brand names for the same kind of fake collaboration platform. ESET documents MATCHY, on two domains, and describes the kit as modular. SCOUTY and TUBIVE come from Help Net Security's report, and the TUBIVE reports originate on Reddit.
What happens after a creator signs in on the fake page?
The operators get the Google password and one-time code, and with them the account's linked services and the channel. ESET describes a victim whose phone number and recovery email were replaced and whose account had new backup codes added, which makes recovery harder.
References
- ESET WeLiveSecurity (7 Oct 2026). Inside a brand deal scam targeting YouTube creators. welivesecurity.com
- Help Net Security (8 Oct 2026). YouTubers targeted with fake sponsorships and "channel verification" phishing. helpnetsecurity.com
- MITRE ATT&CK. T1656, T1566.002, T1598.003, T1098. attack.mitre.org
Related posts
More from the AegisAI blog.