Inside a brand deal scam targeting YouTube creators

This phishing campaign targets YouTube creators by sending personalized emails that impersonate legitimate brands offering sponsorship deals. The attackers reference specific videos to increase credibility and direct victims to fraudulent websites featuring fake campaign metrics and income calculators. Victims are then prompted to sign in with their Google accounts, where attackers either capture credentials or request broad account permissions. Once access is gained, attackers lock victims out by altering recovery settings and exploit the compromised accounts to spread scams. The campaign uses multiple domains such as matchyjoin.com and joinmatchy.com and operates globally, including in Peru, Japan, and English-speaking countries.

Successful compromise leads to theft of Google account credentials or abuse of OAuth permissions, resulting in account takeover. Attackers can lock victims out by changing recovery methods and misuse the accounts to distribute scams to the victims' followers, potentially causing reputational damage and further victimization.

No official patch or fix applies as this is a social engineering phishing campaign. Defenders should educate targeted users about the scam, verify sponsorship offers independently, and be cautious of unsolicited emails requesting Google sign-in via unfamiliar platforms. Use multi-factor authentication (MFA) on Google accounts to reduce the risk of account takeover. Monitor for suspicious account recovery changes and unauthorized activity. The campaign uses known malicious domains such as matchyjoin.com and joinmatchy.com, which should be blocked or monitored.