/
← Voltar ao feed
medium media content creators

Brand deal scam impersonating Hollyland, Nike and Spotify hijacks YouTube creators' Google accounts

1 fonte(s) · 1 atualização(ões) · publicado 07/10/2026 06:00 · coletado há 3 dias

A modular phishing campaign targets YouTube creators with personalized sponsorship offers from fake brand representatives. One variant impersonates Hollyland, a maker of wireless video transmission equipment, and also Nike and Spotify. Victims are led through a convincing fake collaboration platform to a bogus "Sign in with Google" page that captures their password and one-time code. The campaign has reached creators in Peru, Japan and the English-speaking world, and its domains and brand identities changed repeatedly between June and August. Hollyland has itself warned about the scam.

Detalhes técnicos

  • The lure is a personalized email, for example a "Paid collaboration opportunity" from a sender calling herself "Brandi" of Hollyland's Creator Partnerships team. It references specific videos from the target's channel, and the sender domain is unrelated to Hollyland.
  • After the victim replies with rates, they are sent to joinmatchy[.]com/hollyland to "verify" channel statistics, the agreement and payment.
  • The fake platform shows campaign metrics, major company logos, an income calculator and contract/payment automation. It asks for the YouTube channel URL to pull public data and personalize the experience.
  • The final step is a Google sign-in page, supposedly to verify channel ownership. A fake login page captures the password and one-time code, giving access to the account, recovery methods, Gmail and Google Drive.
  • A genuine OAuth flow would share only name, email and profile picture unless broader permissions, such as managing the YouTube channel, are requested.
  • One victim reported that attackers replaced her phone number and recovery email and added their own backup codes to block recovery.
  • Variants use other brands and domains, including some containing "Scouty". They share favicons, meta descriptions and parts of their source code.
  • Compromised accounts can be used to reach followers and collaborators, spread malicious links and run further scams.

Remediação

  • Verify sponsorship offers through the brand's official channels, and check the sender and platform domains.
  • Before using any SSO option, confirm the sign-in page is on the provider's own domain (for example accounts.google.com) and review the permissions requested.
  • Use strong, unique passwords, 2FA and passkeys.
  • If compromised, run Google's Security Checkup, remove unknown devices, apps and access, change the password and enable 2FA.
  • Use Google's official account recovery if locked out, then revert attacker changes to the phone number, recovery email and backup codes.

Linha do tempo

  1. welivesecurity.com ↗ · pub. 07/10/2026 06:00 · coletado 19/10 18:00 primeiro registro

    Brand deal scam impersonating Hollyland, Nike and Spotify hijacks YouTube creators' Google accounts

    ler a análise desta fonte

    A modular phishing campaign targets YouTube creators with personalized sponsorship offers from fake brand representatives. One variant impersonates Hollyland, a maker of wireless video transmission equipment, and also Nike and Spotify. Victims are led through a convincing fake collaboration platform to a bogus "Sign in with Google" page that captures their password and one-time code. The campaign has reached creators in Peru, Japan and the English-speaking world, and its domains and brand identities changed repeatedly between June and August. Hollyland has itself warned about the scam.

    Technical Details

    • The lure is a personalized email, for example a "Paid collaboration opportunity" from a sender calling herself "Brandi" of Hollyland's Creator Partnerships team. It references specific videos from the target's channel, and the sender domain is unrelated to Hollyland.
    • After the victim replies with rates, they are sent to joinmatchy[.]com/hollyland to "verify" channel statistics, the agreement and payment.
    • The fake platform shows campaign metrics, major company logos, an income calculator and contract/payment automation. It asks for the YouTube channel URL to pull public data and personalize the experience.
    • The final step is a Google sign-in page, supposedly to verify channel ownership. A fake login page captures the password and one-time code, giving access to the account, recovery methods, Gmail and Google Drive.
    • A genuine OAuth flow would share only name, email and profile picture unless broader permissions, such as managing the YouTube channel, are requested.
    • One victim reported that attackers replaced her phone number and recovery email and added their own backup codes to block recovery.
    • Variants use other brands and domains, including some containing "Scouty". They share favicons, meta descriptions and parts of their source code.
    • Compromised accounts can be used to reach followers and collaborators, spread malicious links and run further scams.

    Remediation

    • Verify sponsorship offers through the brand's official channels, and check the sender and platform domains.
    • Before using any SSO option, confirm the sign-in page is on the provider's own domain (for example accounts.google.com) and review the permissions requested.
    • Use strong, unique passwords, 2FA and passkeys.
    • If compromised, run Google's Security Checkup, remove unknown devices, apps and access, change the password and enable 2FA.
    • Use Google's official account recovery if locked out, then revert attacker changes to the phone number, recovery email and backup codes.