A phishing campaign is targeting YouTubers with phony sponsorship offers, according to researchers at ESET. The emails are personalized to each target, making specific references to their channels, and are designed to trick users into granting access to their Google accounts.
“One such recent campaign impersonates Hollyland, a legitimate manufacturer of wireless transmission and audiovisual equipment,” ESET says. “We’ve traced the scheme from the first contact and the negotiations of a supposed partnership through to the login request. We’ve also spotted several variants where fraudsters repackage the campaign using different brand identities and domains.”
In addition to Hollyland, the campaign also impersonates Nike and Spotify. The attackers take their time to build trust with the target and only send them a link to the phishing page once the user is well into contract negotiations.
“Unlike many other phishing attacks, this scheme doesn’t immediately ask the user for their password or other sensitive information,” the researchers write. “Instead, the prospective victim is first taken through a series of plausible-looking steps. For example, the fraudulent website features campaign metrics, logos of major companies, and other hallmarks of an established platform. It also contains an income calculator to estimate how much a creator could make from the collab, as well as several features designed to automate contract negotiations, joint projects, and payments. The platform also asks for the creator’s YouTube channel URL, which it uses to retrieve public information and generate a seemingly personalized experience.”
ESET offers the following advice to help users avoid falling for these attacks:
- “Confirm the offer through an official channel: If a brand contacts you to offer a sponsorship, find its official contact details independently and verify both the proposal and the person who sent it.”
- “Check the domains: Look closely at the sender’s email address and the domain of any platform you may be directed to. Professional design and familiar branding don’t make a site legitimate.”
- “Check before signing in with Google, Apple, Facebook or any other single sign-on (SSO) option, or before granting access. Make sure the sign-in page sits on the provider’s own domain (e.g., accounts.google.com) – a bogus page can look identical to the real one. Then inspect the permissions list – for example, a site that only needs to verify your channel has no reason to manage it. Don’t authorize applications or services you don’t recognize.”
- “Use strong and unique passwords, along with two-factor authentication, on all your accounts, and consider using passkeys.”
ESET has the story: https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/
