ESET: scammers hijack YouTubers' Google accounts via fake sponsorship deals

ESET has exposed a phishing campaign targeting YouTube creators: attackers pose as Hollyland, Nike and Spotify, negotiate sponsorship rates and lure victims to fake collaboration platforms MATCHY and SCOUTY that request a Google sign-in. Entering credentials and a one-time code hands over Gmail, Drive and the YouTube channel itself.

• Scammers impersonate Hollyland, Nike, Spotify and Maono
• Fake MATCHY and SCOUTY platforms mimic campaign metrics and earnings calculators
• Signing in exposes Gmail, Drive and the YouTube channel
• ESET advises checking the sign-in domain and enabling 2FA or passkeys