[REVISION HISTORY]

YouTube creator phishing campaign

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-10-08 05:51 UTC → 2026-10-12 10:44 UTC · added ~~removed~~

Cybersecurity experts have identified a sophisticated phishing campaign targeting YouTube content creators, particularly in Latin America, through fraudulent sponsorship offers. Attackers impersonate legitimate global brands to establish credibility, often using personalized emails that reference a creator’s specific content. The scam typically involves a transition from commercial negotiations to a request for the victim to log in to a fraudulent platform that mimics a professional collaboration site. Under the guise of verifying channel statistics, agreements, or payments, the platform solicits Google login credentials to hijack accounts. In documented cases, scammers have impersonated the audiovisual equipment manufacturer Hollyland. While the company is legitimate, it has clarified it was not involved in these communications. Investigators note that malicious actors frequently change brand identities, names, and domains to evade detection. Cybersecurity firm ESET has issued a warning regarding the scheme, noting that attackers may impersonate well-known brands such as Nike and Spotify. To build trust, the method uses a multi-step process where creators are invited to visit professional-looking fake collaboration platforms. These sites may feature campaign metrics, brand logos, and income calculators. They may also request a creator’s YouTube URL to gather public information, further enhancing the illusion of legitimacy before attempting to compromise the user’s account.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.