Fake YouTube Sponsorships Steal Creators' Gmail and 2FA Codes

A journalist in Peru who runs a YouTube channel got a "Paid collaboration opportunity" from someone calling herself "Brandi" from Hollyland's Creator Partnerships team. Hollyland is real. It makes wireless audio and video gear that creators actually buy. Brandi was not, and neither was the platform she pointed to.

On October 7, 2026, ESET researcher Christian Ali Bravo published a walkthrough of the campaign. Help Net Security followed a day later with more domains and a second fake agency. The scam skips malware entirely. It runs on patience, a convincing website, and one sign in page.

Key Takeaways

• ESET published research on October 7, 2026 describing a brand deal scam that impersonates Hollyland, with near identical variants posing as Nike and Spotify.
• MATCHY (joinmatchy[.]com and matchyjoin[.]com) and SCOUTY (joinscouty[.]com) are the fake collaboration platforms ESET found, and Help Net Security links a third name, TUBIVE (mytubive[.]com), to other reported attempts.
• The fake platform asks creators to sign in with Google to verify channel ownership, and an impostor login page captures the password and the one time code, handing over Gmail, Google Drive and the YouTube channel.
• One victim said the attackers replaced her phone number and recovery email and added their own backup codes to block recovery.
• Google's 2021 takedown of a similar sponsorship campaign blocked 1.6 million phishing messages, but that wave pushed malware downloads, while the 2026 version needs only a fake sign in page.

How Does the Fake Sponsorship Scam Work?

The scam walks a creator through a normal looking brand deal and only asks for a Google sign in at the very end. The ESET research on WeLiveSecurity lays out the steps in order:

1. The pitch. A personalized email references specific videos from the creator's channel and offers a device plus "the prospect of a long-term collaboration." The sender's domain has nothing to do with Hollyland.
2. The negotiation. After the target replies with her rates, the scammer sends a second email directing her to joinmatchy[.]com/hollyland, where channel statistics, the agreement and payment would supposedly be verified.
3. The platform. The site shows campaign metrics, logos of major companies, an income calculator and tools that claim to automate contracts and payments. It asks for the creator's YouTube channel URL and pulls public data to make the page feel personal.
4. The trap. The next step is a Google sign in page, framed as proof that the creator owns the channel.

ESET points out that, "Unlike many other phishing attacks, this scheme doesn't immediately ask the user for their password." That delay is the whole design. By the time the login appears, the target has already invested an email thread, a rate quote and a few minutes inside a believable dashboard.

Which Brands and Domains Are Involved?

ESET documented Hollyland, Nike and Spotify as the impersonated brands, running on MATCHY and SCOUTY domains that change often. The researchers describe "a 'modular' scheme" in which the sites "share favicons, meta descriptions and portions of their source code" while the fake brand identity rotates. According to ESET, the domains and names "changed repeatedly between June and August," and the emails reached creators in Peru and Japan as well as English speaking creators.

Help Net Security's October 8 report adds names that are not in ESET's post:

• TUBIVE at mytubive[.]com, which Help Net ties to other publicly reported scam attempts rather than to ESET's own findings.
• Maono, named alongside Hollyland, Nike and Spotify as a name the senders borrowed.
• Creoventura at creoventura[.]com, an "agency" that gaming furniture maker AndaSeat publicly disowned: "Creoventura is NOT affiliated with AndaSeat in any way."

Help Net's look at Creoventura is a useful checklist on its own. The UK company register spells the name Creoventure and lists IT, management and engineering consultancy as its business. The site's social icons point to generic homepages. Its domain was registered in August 2026 through Namecheap for one year with hidden ownership.

Why Doesn't a One Time Code Stop It?

A one time code does not stop it because the victim types the code into the attacker's page along with the password. ESET's description is plain: an impostor login page "captures the password and one-time code, and with them the account itself." Any second factor that a person reads and types can be phished the same way, which is why we keep covering kits like Tycoon 2FA that exist only to relay those codes.

ESET also separates the real flow from the fake one. Genuine Sign in with Google, by default, shares only a name, email address and profile picture with the requesting site. It can ask for more, such as permission to manage the YouTube channel, which "would let attackers upload or delete videos." A lookalike page skips the permission screen and takes the credentials directly.

Once inside, the attackers in one documented case moved fast. They replaced the victim's phone number and recovery email with their own and added their own backup codes, "all to hamper account recovery efforts."

Same Lure, New Payload: 2021 Versus 2026

Fake sponsorships aimed at YouTubers are not new. Google's Threat Analysis Group described a near identical opening move in an October 2021 report on cookie theft campaigns: "a customized email introducing the company and its products," sent by actors recruited on a Russian speaking forum. TAG counted around 15,000 actor accounts and said Google had blocked 1.6 million messages to targets.

The payload is what changed. In 2021 the deal led to a "software demo" that installed cookie stealing malware. TAG's advice reflected that: scan files before running them and beware encrypted archives. The 2026 campaign ESET describes asks for no download at all. It needs only a browser tab and a sign in form.

That shift sidesteps most of the 2021 defenses. Antivirus and download scanning have nothing to inspect when nothing is downloaded. What remains is the creator's judgment at the sign in screen and the type of second factor on the account.

Why Email Users Should Care

The attack starts in an inbox, and it is after an inbox. TAG noted in 2021 that "Many YouTube creators provide an email address on their channel for business opportunities." That public business address is exactly where these personalized pitches land, and it is often the same Gmail account that owns the channel.

ESET warns that a hijacked creator account can be used to "impersonate them to contact your followers or collaborators." A stolen Gmail account carries years of sent mail, contracts in Drive and a contact list of brands and other creators. Each of those contacts receives the next pitch from an address they already trust. We saw the same pattern when fake job interviews were used to steal Google logins: a believable business conversation, then a sign in request.

You don't need a channel to be targeted this way. Swap "sponsorship" for "freelance contract" or "podcast guest invite" and the same sequence could work on anyone whose email address is public.

How Can Creators Verify a Sponsor and Lock Down Their Google Account?

Verify the brand through a channel you found yourself, then make your Google sign in impossible to phish. These steps follow ESET's advice and Google's own documentation:

1. Contact the brand independently. ESET says to find the company's official contact details yourself and confirm both the offer and the person who sent it. Do not reply to the email or use its links.
2. Read the sender domain. In ESET's Hollyland case, the domain was "unrelated to Hollyland." A real brand manager writes from the brand's domain or a known agency.
3. Treat any sign in request on a sponsor platform as a red flag. Verifying channel statistics does not require your Google password. ESET's rule: confirm the sign in page sits on the provider's own domain, such as accounts.google.com, because "a bogus page can look identical to the real one." Our guide to spotting fake login popups shows how to test a window that only looks like Google.
4. Read the permission screen. As ESET puts it, "a site that only needs to verify your channel has no reason to manage it."
5. Switch to a passkey. YouTube's Secure your YouTube channel page tells creators to set up 2-Step Verification with a passkey and lists phone verification codes as a "Less secure type." Google's passkey help page says passkeys "can't be shared, copied, written down, or accidentally given to someone else."
6. Consider Advanced Protection for a large channel. Google's Advanced Protection Program requires a passkey or security key, so unauthorized users cannot sign in "even if they know your username and password." It also allows only Google apps and verified third party apps to access your account data.
7. Set recovery options now. YouTube's guidance asks creators to add a recovery phone number and email before trouble starts.

What Should You Do If You Already Signed In?

Run Google's Security Checkup immediately, then change your password. ESET advises reviewing recent security events, signed in devices, sign in methods, recovery information and third party connections, and removing anything you don't recognize. Turn on two factor authentication if it is off.

If you're locked out, or you find a new phone number, recovery email or backup codes you didn't add, go to Google's account recovery page. Don't go back to the scam site. For the channel itself, YouTube's Recover a hacked YouTube channel page says you must recover the Google Account first, and warns that if the issue "happened more than 9 months ago, we may not be able to recover your channel."

Speed matters for one more reason. Your hijacked inbox may already be sending the same sponsorship pitch to the creators in your contacts.