Fake brand deals phish YouTube creators’ Google accounts

ESET says scammers impersonate brands to phish YouTube creators and take over Google accounts.

ESET documented a phishing campaign, seen from June through August 2026, that sends YouTube creators personalized sponsorship emails impersonating brands including Hollyland, Nike, and Spotify. Victims are directed to polished fake collaboration sites—ESET cites joinmatchy[.]com and Scouty-branded domains, while Help Net Security names MATCHY, SCOUTY, and TUBIVE—that request a Google sign-in, framed by Help Net Security as channel verification, and can capture passwords and one-time codes. After access, attackers change recovery phone numbers and emails; ESET says they replace backup codes, whereas Help Net Security reports that one creator said new backup codes were generated. The campaign targeted creators in Peru, Japan, and English-speaking regions. Help Net Security also notes AndaSeat’s separate warning that an agency called Creoventura is not affiliated with the company, and that ESET recommends independent verification plus strong two-factor authentication or passkeys.

• ESET documented a phishing campaign that sends YouTube creators personalized sponsorship emails impersonating Hollyland, Nike, and Spotify.
• The campaign was seen from June through August 2026 and targeted creators in Peru, Japan, and English-speaking regions.
• Fake collaboration sites include joinmatchy[.]com and Scouty-branded domains (ESET) and platforms named MATCHY, SCOUTY, and TUBIVE (Help Net Security).
• Those sites lead to a Google sign-in flow, described as channel verification in Help Net Security’s account, that can capture passwords and one-time codes.
• Attackers then change recovery phone numbers and emails; ESET says they replace backup codes, while Help Net Security says one creator reported that new backup codes were generated.
• AndaSeat separately warned that an agency called Creoventura is not affiliated with the company.
• ESET advises independent verification and strong two-factor authentication or passkeys.