Fake Sponsorship Scam Targets YouTube Creators, Threatens Google Account Takeover

A growing scam targets YouTube content creators through fake sponsorship emails impersonating major brands like Nike and Spotify. Attackers lure creators to sophisticated counterfeit collaboration platforms, then redirect them to fake Google login pages designed to steal passwords and two-factor authentication codes, resulting in complete Google account compromise.

How the Scam Works

This fraud begins with seemingly legitimate sponsorship offers impersonating well-known global brands. Victims receive personalized emails referencing their YouTube channel content, designed to appear credible and trustworthy.

Step-by-Step Process

Initial Contact: Emails impersonating Nike, Spotify, Hollyland, and other major brands offering sponsorship deals
Redirect to Fake Platform: Victims are directed to counterfeit collaboration platforms that closely mimic legitimate sites
Channel Information Submission: Creators enter their YouTube channel URLs into the fake platform
Credential Harvesting: Victims are redirected to a fake Google login page that captures passwords and two-factor authentication codes

Advanced Deception Tactics

Unlike traditional phishing, this scam does not directly request passwords. Instead, it employs a sophisticated multi-step process that convinces victims to voluntarily enter their credentials. The fake platforms include revenue calculators, performance metrics, and logos of major companies to build credibility.

Security Risks of Account Takeover

Once a Google account is compromised, attackers gain access to:

Gmail: Complete email account and all stored communications
Google Drive: All stored files and documents
YouTube Channel: Full channel control for malicious purposes
Connected Services: Google Photos and other linked applications

Compromised accounts are typically exploited to spread malicious links to followers, conduct fraud campaigns, and establish footholds for further attacks.

Warning Signs and Verification Steps

Verify Sender Email Domain: Confirm the email comes from an official brand email address or registered company domain
Check Language and Tone: Professional companies use standardized templates; overly casual or awkward phrasing is a red flag
Hover Over Links: Move your mouse over links to see the actual destination URL before clicking
Examine Platform URLs: Fake platforms may have URLs that differ subtly from legitimate ones; compare carefully
Contact the Brand Directly: If in doubt, reach out to the sponsoring company through official channels to verify the offer

Prevention Tips

Strengthen Two-Factor Authentication: Enable two-factor authentication on Google accounts and use app-based authenticators rather than SMS codes
Use Strong, Unique Passwords: Create complex passwords and avoid reusing them across multiple accounts
Never Click Suspicious Links: Access company websites directly rather than through email links in sponsorship offers
Verify Sender Information: Always confirm the sender's email address is from an official domain
Use Official Google Resources: When uncertain, consult Google's official security pages
Enable Browser Security Features: Activate Google Chrome's security features and heed warnings about dangerous sites

Reporting and Support

Google Security Support: Report suspected account compromise to Google's official support team
FBI Internet Crime Complaint Center (IC3): For international fraud cases
National Cybercrime Units: Report to your country's police or cybersecurity agency
YouTube Creator Support: Notify the platform of security threats