That Hollyland Brand Deal Email Wants Your Google Account, Not a Sponsorship
Creators dream about brand deals. Criminals dream about creators who dream about brand deals. ESET’s WeLiveSecurity team mapped a modular campaign that opens with a personalized “paid collaboration” email, walks you through a slick fake platform that scrapes your public channel stats, then parks you on a Google sign-in step that is either a permission grab or a straight password-and-OTP harvest. Hollyland warned about it. Nike and Spotify skins showed up too. Your channel is the collateral.
Christian Ali Bravo’s October 7, 2026 writeup walks a Peru-based journalist through a pitch from “Brandi” on Hollyland’s supposed Creator Partnerships team. The note referenced specific videos. Rates got discussed like a real negotiation. Then came the pivot: join joinmatchy[.]com/hollyland (and siblings like matchyjoin[.]com) to “verify” performance, agreement, and payment. The sender domain was not Hollyland. That should have been the whole article. It never is.
Why the platform feels legit until it does not
These lures do not open with “paste your password.” They open with theater:
- Campaign metrics, brand logos, income calculators
- Contract and payment automation cosplay
- A field for your YouTube URL that pulls public channel data so the page feels personalized
- Variants branded Scouty, MATCHY, TUBIVE, and whatever vowel soup trends next
ESET notes shared favicons, meta descriptions, and chunks of source across the Nike and Spotify reskins. Same factory, different sticker. Targets showed up in Peru, Japan, and English-speaking creator circles between at least June and August, with domains rotating on a schedule that would make a phishing kit blush.
The Google step is the kill shot
Eventually the site asks you to sign in with Google to prove you own the channel. Real OAuth on accounts.google.com can be limited to basic profile fields. A fake login page takes password plus one-time codes and then owns Gmail, Drive, recovery options, and the YouTube channel. Even a “real” OAuth consent screen is dangerous if you grant channel-management scopes to a stranger’s client.
One creator who got hit described the classic lockout play: attackers swapped phone number and recovery email, added their own backup codes, and turned account recovery into a support ticket nightmare. That is not “brand liaison energy.” That is a hostage situation with better typography.
Related noise worth not confusing
OTX mirrored the brand-deal pulse under tags like Google account compromise and SSO abuse. Separately, ThreatFox has been busy with ClearFake domains (example recently seen: amanahtop.us.com), Vidar C2 URLs, and the usual stealer buffet. Those campaigns overlap thematically (“browser does something bad”) but are not the same operator set just because both want credentials. Attribute what ESET attributed. Block the rest on their own merits.
Creator checklist (print it, tape it to the ring light)
- Verify out of band. Find the brand’s real partnerships email from their site or a prior contract. Ask if Brandi exists. Spoiler: often no.
- Read the sender domain and the platform domain. Pretty CSS is not a certificate of incorporation.
- Inspect the real URL before any SSO. It should be the identity provider’s domain. Hover is not optional.
- Audit OAuth scopes. Verifying a channel does not require permission to upload, delete, or manage finances.
- Passkeys / strong unique passwords / 2FA. Yes, still. Especially on the Google account that is your entire business.
If you already clicked the trap
- Run Google Security Checkup immediately. Kill unknown devices, apps, and sessions.
- Change password from a device you trust. Rotate 2FA. Review recovery phone and email.
- If locked out, use Google’s official recovery flow only. Do not type anything into the scam portal “to fix it.”
- Tell collaborators. Attackers love pivoting from a compromised creator inbox into the next mark.
- Document timelines for platform support. YouTube recovery is slower when you only have vibes.
What platforms and brands should do (yes, you)
Hollyland publicly warned. More brands should. Publish a canonical partnerships contact. Watermark outreach. Teach creator relations teams that “we got spoofed” is a predictable risk, not a surprise boss fight. YouTube and Google already have security checkup plumbing. The missing piece is creator-facing education that matches the sophistication of these funnels, not another cartoon padlock.
SSO literacy in one paragraph
Real Google sign-in lives on Google’s domain and shows a permissions list you can refuse. Fake Google sign-in lives on the scammer’s domain and captures secrets. Compromised-but-real OAuth lives on Google’s domain and still ruins your week if you approve “manage your YouTube account” for a site you met in a cold email. Teach creators all three failure modes. One cartoon about “look for the lock” is how we got here.
For the CISO whose employees are also creators
Side projects leak into corporate Google workspaces more often than policy PDFs admit. If staff use company Google accounts for personal channels, a brand-deal phish becomes a tenant incident. Separate identities. Hardware keys for admins. Alert on new OAuth grants with YouTube management scopes. Your DLP tools will not save a channel that already handed over backup codes.
Red flags in the first email
- Generic first name + big brand, sent from a domain that fails a ten-second WHOIS / website cross-check
- Urgency around “verification platforms” before a contract is countersigned on paper or through a known agency
- Requests to move the conversation off email onto a site that needs SSO immediately
- Offers that are oddly specific about your last three videos but oddly vague about budget approval chains
- Pressure to “complete onboarding today” so payment can “clear”
Real brands are slow, bureaucratic, and annoying. That annoyance is a feature. Scams are polite and fast. Choose annoying.
Incident tabletop for agencies
Creator agencies should tabletop a compromised Google account the way MSSPs tabletop ransomware. Who talks to YouTube support? Who notifies sponsors that emails from the creator may be attacker-operated? Who freezes payouts? Who rotates shared passwords sitting in a Notion page from 2023? If your answer is “the talent handles it,” you are not an agency. You are a calendar app with a commission.
Sloth take
The creator economy trained millions of people to jump when a brand says “collab,” then bolted their livelihoods to a single Google login. Criminals noticed. MSPs and “influencer security startups” will now sell workshops. The actual fix is rude and cheap: distrust cold sponsorship email, verify domains, and stop granting God-mode OAuth to websites that learned your subscriber count from the public API. Your channel is not a lifestyle. It is an account. Defend it like one.
Need a grown-up to look at your edge stack? Book a slot with Dark Edge Consulting. We do the boring, careful work so you can go back to ignoring your inbox.
Sources
- ESET WeLiveSecurity, Inside a brand deal scam targeting YouTube creators (2026-10-07): welivesecurity.com
- Help Net Security summary of fake sponsorship and channel verification phishing (2026-10-08)
- AlienVault OTX pulse on brand-deal / SSO abuse campaigns
- ThreatFox recent ClearFake / stealer telemetry (adjacent browser threat landscape; not claimed as same actors)
