Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA sponsorship pitch can look personal and a collaboration site can look polished while still being designed to steal a creator’s Google credentials. In a campaign reported by ESET on October 7, 2026, creators were approached with tailored brand offers and then asked to sign in to Google to “verify” their YouTube channel. Confirm offers through contact details you find independently, check every domain and permission request, and use Google’s official recovery tools immediately if you entered a password or verification code.
How the fake sponsorship scheme works
ESET’s October 7, 2026 report describes a pitch that may refer to a creator’s videos, discuss rates, and then direct them to a fabricated collaboration platform. Reported sites used brand logos and included features such as campaign metrics, contract and payment tools, an earnings calculator, and a request for the creator’s public channel URL to personalize the page. The apparent next step—signing in with Google to confirm channel ownership—is the credential-harvesting lure.
As an Amazon Associate I earn from qualifying purchases.
ESET reported one campaign impersonating Hollyland, with variants using Nike and Spotify identities. Names included MATCHY and SCOUTY. ESET describes the operation as modular: branding and domains can change even when some site components and functionality remain similar. Those names are examples, not a complete or durable blocklist. ESET researchers wrote that “This all points to a ‘modular’ scheme that retains certain components while altering the bogus identity used to reel in each creator.” Read ESET’s report.
What a fake Google sign-in can expose
If the sign-in page is an impostor, entering a password and one-time code can give attackers access to the broader Google account—not just YouTube—including Gmail, Drive, and account recovery settings. That is different from a genuine Google sign-in or an authorization screen: a legitimate sign-in shares limited profile information by default, while permission to manage a YouTube channel is a separate access request. Review what a service asks to do rather than assuming every Google sign-in grants channel control. ESET explains the reported credential-stealing flow.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
With access to an account, an attacker may change recovery information and lock its owner out. They may also misuse the creator’s identity or channel to target followers and collaborators.
How to check whether a sponsorship email is real
- Verify the offer independently. Find the brand’s official website yourself and use its published contact details to ask whether the offer and sender are genuine. Do not rely on phone numbers, email addresses, or links included in the unsolicited pitch. YouTube’s safety guidance also warns creators about suspicious messages.
- Inspect the exact domains. Check the sender’s email domain and the collaboration site’s full address. A familiar logo, professional layout, testimonials, campaign figures, or a plausible company number does not establish legitimacy.
- Check where the sign-in happens. Google credentials should be entered only on Google’s genuine sign-in domain. ESET cites
accounts.google.comas an example; YouTube says never to enter a Google password on a site other thanmyaccount.google.com. Type the address yourself or use a trusted bookmark rather than following a sign-in link from the pitch. YouTube Help: Stay safe on YouTube. - Read the permissions screen. A claim that a site needs to verify channel ownership does not justify granting it permission to manage the channel. Do not authorize an unfamiliar service or access that is not necessary for a confirmed purpose. Learn about YouTube channel permissions.
- Do not open untrusted files or links. YouTube says it will never ask for a password, email address, or other account information by email, message, or phone call. Its guidance recommends scanning downloads and enabling Enhanced Safe Browsing; encrypted files can evade antivirus scans. Review YouTube’s account-safety recommendations.
- Protect the account and delegate safely. Use a strong, unique password and enable 2-Step Verification. YouTube recommends a passkey as the second verification method for stronger phishing protection. If someone needs to help manage a channel, use YouTube channel permissions instead of sharing the Google Account password; permissions provide channel access without giving that person access to the Google Account. YouTube channel permissions.
What to do if you entered your password or verification code
Act promptly, and do not return to the suspicious site to enter credentials again or grant additional access.
Rank #2
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- Open Google’s Security Checkup from a trusted browser or device. Review recent security events, signed-in devices, recovery information, and third-party connections. Remove anything you do not recognize.
- Change the Google Account password to a new, unique one and enable two-factor authentication if it is not already active.
- If you cannot sign in or recovery details were changed, use Google Account recovery. For a compromised YouTube channel, follow YouTube’s hacked-channel recovery guidance.
- After regaining access, reverse unauthorized changes and remove unknown app, device, or third-party access. Check recovery settings again so an attacker has not left a way back in.
If you want to report an internet scam or account takeover in the United States, the FBI’s October 2024 advisory directs victims to the Internet Crime Complaint Center (IC3). The advisory addresses account takeovers and internet scams broadly, not a victim count for this specific campaign. FBI advisory.
What the current reports establish—and what they do not
ESET’s report documents a specific reported pattern; it does not provide a reliable aggregate victim count or prevalence estimate for the October 2026 campaign. Google’s figures from an earlier, separate campaign should not be mistaken for current victims.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
In an October 20, 2021 report, Google’s Threat Analysis Group described a different operation in which fake collaboration offers led creators to malware disguised as software. That malware stole browser cookies, enabling session hijacking; Google said affected channels were later sold or used for cryptocurrency scam livestreams. For that earlier campaign, Google reported blocking 1.6 million messages and 2,400 files, displaying approximately 62,000 Safe Browsing phishing-page warnings, restoring approximately 4,000 accounts, and seeing a 99.6% decrease in related Gmail phishing-email volume since May 2021. Google also said it identified at least 1,011 domains created solely for that malware campaign. These are Google’s response metrics for the 2021 operation, not estimates of victims or reach for the 2026 fake-verification reports. Google Threat Analysis Group’s 2021 account-takeover report.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
