The most effective attack on a creator does not look like an attack. It looks like revenue.

A message arrives from a brand you recognize. The sender has a title, a signature block, and a budget. There is a PDF or a link to a “campaign brief.” The deal is real enough that you want it to be real. That is the entire strategy.

Security firm CloudSEK documented a single phishing campaign that targeted more than 200,000 YouTube creators with fake brand-deal emails. That is not a boutique scam. It is an industry, and it runs on volume.

How the email is built

The pieces are standardized. Once you know them, you will recognize them in the first ten seconds.

The lookalike domain

The sender address is almost right. The real company is at “brand.com”; the email comes from “brand-partnerships.com”, “brand-collab.co”, or “brandofficial.net”. These domains are usually registered days before the campaign begins. Whois data on the domain will show a creation date measured in days or weeks, often behind a privacy proxy. Legitimate brands do not spin up new domains to send outreach.

The attachment that isn’t a contract

The “contract” or “brief” does one of two things. Either it is an executable dressed up as a document (a .zip, .scr, .exe, or a password-protected archive that your mail scanner cannot inspect), or it is a real PDF with a single link inside that leads to a credential page. Infostealer malware delivered this way does not ask for your password. It takes the session cookies already in your browser and hands the attacker a logged-in copy of your channel. Two-factor authentication does not stop a stolen session.

The trusted host

Files are frequently hosted on OneDrive, Google Drive, Dropbox, or Notion. The link looks legitimate because the hosting is legitimate. The attacker simply uploaded a malicious file to a free account. A Microsoft domain in the URL tells you where the file lives, not who put it there or what it does.

The clock

There is always a deadline. The campaign launches Monday. The budget closes this week. The brand “needs a reply within 24 hours to hold your slot.” Urgency is there to stop you from doing the one thing that defeats the whole operation: checking.

What happens after the click

If the payload is a credential page, the attacker logs in, changes the recovery email and phone, and locks you out. If it is an infostealer, they skip the login entirely and simply use your session. From there the channel is renamed, the videos are hidden, and a crypto livestream goes up under your subscriber count. Bitdefender Labs tracked more than 9,000 malicious livestreams running on hijacked YouTube channels, including one compromised channel with 28.1 million subscribers. The audience you spent years building becomes the lure for the next round of victims.

Red flags, in order of reliability

  • The domain is new. Check the registration date. Under 90 days is disqualifying.
  • The sender domain does not match the brand’s actual website. Hyphens, extra words, and alternate TLDs are not variations. They are different owners.
  • The attachment is an archive or requires a password to open. Real contracts arrive as PDFs or via a signing platform.
  • The file is hosted on a personal cloud account rather than the brand’s own domain or an agency’s.
  • The brief asks you to “preview” or “download” software, a game build, a “media kit viewer,” or anything executable.
  • There is no human on the other end. Replies come fast, generic, and never offer a call.
  • The money is slightly too good for your current numbers, and nobody asks for your rates.

Spelling and grammar are no longer reliable signals. The emails are clean. Judge the infrastructure, not the prose.

The 60-second verification routine

  1. Read the actual sender address, not the display name. Expand it. Compare the domain, character by character, against the brand’s real website.
  2. Look up the domain’s registration date. Any whois tool will do. Days or weeks old means stop.
  3. Hover over every link and read the real destination. If it is a file-sharing host, treat the file as unknown.
  4. Do not open attachments on the machine you use to log in. If you must look, use a phone, a spare device, or a sandbox.
  5. Verify out of band. Find the brand’s partnerships contact through their official site or LinkedIn and ask if the outreach is genuine. Never use the contact details in the suspicious email.
  6. Ask for a call. Real agencies take meetings. Phishing operations do not.

Sixty seconds is a generous estimate. Most of these fail at step one.

Structural fixes that make this boring

Route all business inquiries to a dedicated inbox that is not the login email for any of your platforms. Have a manager or assistant triage that inbox from a device that holds no creator credentials. Use hardware security keys on the Google account behind your channel so that a stolen password is useless, and clear active sessions on a schedule so a stolen cookie has a short life. Keep a short list of agencies and brand contacts you have actually worked with, and treat anyone outside that list as unverified by default.

None of this is paranoid. It is simply the cost of being someone worth impersonating.

Where ShutOut comes in

ShutOut hardens the accounts behind your channel so a phished password or stolen session does not become a takeover, monitors for lookalike domains and impersonation targeting your name and brand, and runs takedowns when they appear. If something has already gone wrong, our incident response team works the recovery with the platforms directly, so you are not negotiating with a support form alone.