Brand Deal Phishing Campaign Targeting YouTube Creators: SSO Abuse & Google Credential Theft — OTX Pulse Detection Pack

Threat Summary

AlienVault OTX pulse data (modified 2026-10-12, TLP:WHITE, originally reported by ESET/welivesecurity) documents a sophisticated, highly personalized phishing campaign targeting YouTube content creators in Japan and Peru, with infrastructure and tradecraft consistent with a financially motivated credential-theft operation. Although no named malware family is attached to the pulse, the campaign's objective is unambiguous: full compromise of creator Google accounts and the YouTube channels bound to them, which are then monetized through resale on dark web credential markets, crypto-scam livestream hijacking, or extortion.

The attack chain observed across this campaign:

1. Reconnaissance & personalization — Operators scrape target channels and craft sponsorship outreach emails referencing specific videos from the victim's own channel, impersonating legitimate consumer brands including Hollyland, Nike, and Spotify. This is not spray-and-pray phishing; the lure content passes casual scrutiny because it mirrors genuine influencer-marketing workflows.
2. Redirect to fraudulent collaboration platforms — Victims are directed to attacker-controlled portals (e.g., joinmatchy.com/hollyland) that convincingly mimic real influencer-marketing SaaS products, complete with campaign dashboards, fake performance metrics, and income calculators to sustain the illusion and justify the next step.
3. SSO abuse & credential capture — The fraudulent platform prompts the victim to "connect" or "verify" their channel, routing them through a fake Google OAuth/SSO flow that captures credentials (and in many variants, session cookies or OAuth tokens sufficient to bypass MFA).
4. Account takeover & monetization — Compromised Google sessions are used to seize the YouTube channel (changing recovery emails/phones), then either strip the account for dark web resale, push cryptocurrency scam streams to the channel's subscriber base, or pivot into the victim's broader Google Workspace/data footprint.

For enterprise defenders, this matters well beyond individual creators: media companies, agencies, and brands with corporate YouTube channels managed by employees are in scope, and a hijacked corporate channel is both a reputational weapon and a phishing launchpad against the organization's own audience.

Threat Actor / Malware Profile

Attribution: Unknown — no named APT or crimeware group is attached to the pulse. The tradecraft (brand impersonation kits, fake SaaS portals, Google SSO abuse) is consistent with credential-theft-as-a-service operators active in underground forums who specialize in social-media account harvesting for resale. Stolen creator accounts with large subscriber counts command premium pricing on dark web marketplaces because they enable high-reach scam distribution.

Malware families: None identified in this pulse — this is a malware-less, social-engineering-first operation. There is no dropped payload, no persistence mechanism on the endpoint, and no traditional C2. The "payload" is the phishing portal itself:

• Distribution method: Direct personalized email to creators, spoofing brand partnership/sponsorship teams. Sender infrastructure rotates through lookalike and disposable domains.
• Payload behavior: Fraudulent influencer-marketing portals (matchyjoin.com, joinmatchy.com) present fake campaign metrics and income calculators, then funnel the victim into a credential/session capture flow disguised as Google sign-in.
• C2 communication: Web-based exfiltration — captured credentials, OAuth tokens, and session cookies are POSTed from the phishing kit's backend to attacker infrastructure. Session tokens are the prize: they enable MFA bypass via token replay rather than password-only access.
• Persistence mechanism: Post-compromise, actors change recovery email/phone on the Google account and may register their own OAuth grants or app passwords, persisting even after a password reset if recovery artifacts aren't scrubbed.
• Anti-analysis techniques: Kit portals typically serve benign or redirect content to scanners and sandboxes, gate the phishing flow behind the personalized lure link, and use short-lived rotating domains to outrun blocklists.

IOC Analysis

The pulse contains 3 indicators, all network-based: two domains and one full URL path. There are no file hashes or IPs — appropriate for a pure phishing-infrastructure campaign.

Operationalization guidance for SOC teams:

• Domains should be pushed to DNS sinkholes, secure web gateways, and email gateways immediately. Block at the DNS layer (RPZ or protective DNS) so even out-of-band clicks are neutralized.
• The URL path (/hollyland) indicates the kit uses per-brand lure paths — hunt proxy and email logs for the parent domain with any path, since /nike, /spotify, or additional brand slugs likely exist beyond the sampled IOC.
• Expect domain rotation: treat these IOCs as a seed set. Pivot on TLS certificate metadata, registrar, and page templates in tooling like urlscan.io, VirusTotal, and OTX's own pulse correlations to surface sibling infrastructure.
• Because no endpoint malware is involved, network telemetry (DNS, proxy, TLS SNI) and identity telemetry (Google/Azure sign-in logs) are the primary detection surfaces — endpoint hunting alone will miss this campaign entirely.

Detection Engineering

---
title: DNS or Proxy Access to YouTube Creator Brand-Deal Phishing Infrastructure
id: 7f3a2c1e-9b4d-4e5a-8c6f-2d1a9e7b5c30
status: experimental
description: Detects DNS resolution or web requests to known phishing domains impersonating brand sponsorship platforms targeting YouTube creators for Google credential theft (matchyjoin.com, joinmatchy.com).
author: Security Arsenal Threat Intelligence
references:
  - https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/
date: 2026/10/13
logsource:
  category: dns
selection:
  query|contains:
    - 'matchyjoin.com'
    - 'joinmatchy.com'
condition: selection
falsepositives:
  - Threat research or sandbox detonation of the phishing kit
level: high
tags:
  - attack.initial_access
  - attack.t1566.002
---
title: Suspicious Google Account Sign-In Following External Credential Entry
id: 8e4b3d2f-0c5e-4f6b-9d7a-3e2b0f8c6d41
status: experimental
description: Detects Google Workspace/identity sign-in anomalies consistent with phishing-captured session or credential replay — new device, unusual ASN, or impossible-travel sign-in to accounts used for YouTube channel management.
author: Security Arsenal Threat Intelligence
references:
  - https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/
date: 2026/10/13
logsource:
  product: google
  service: workspace
detection:
  selection_event:
    eventName: 'login_success'
  selection_risk:
    riskIndicators|contains:
      - 'new_device'
      - 'suspicious_location'
      - 'impossible_travel'
  condition: selection_event and selection_risk
falsepositives:
  - Legitimate travel by creators or social media staff
  - New device enrollment
level: medium
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1557
---
title: Inbound Email with Sponsorship Lure Keywords and Lookalike Collaboration Domains
id: 9f5c4e3a-1d6f-4a7c-0e8b-4f3c1a9d7e52
status: experimental
description: Detects inbound email combining sponsorship/brand-deal lure language with links to newly registered or non-corporate collaboration domains, matching the YouTube creator phishing campaign's delivery pattern.
author: Security Arsenal Threat Intelligence
references:
  - https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/
date: 2026/10/13
logsource:
  category: email
detection:
  selection_subject:
    Subject|contains:
      - 'sponsorship'
      - 'brand deal'
      - 'collaboration offer'
      - 'partnership proposal'
  selection_brands:
    Body|contains:
      - 'Hollyland'
      - 'Nike'
      - 'Spotify'
  selection_links:
    Links|contains:
      - 'matchyjoin.com'
      - 'joinmatchy.com'
  condition: selection_subject and (selection_brands or selection_links)
falsepositives:
  - Legitimate influencer marketing outreach routed through known brand domains
level: high
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1598

// Sentinel hunt: YouTube creator brand-deal phishing — network + identity correlation
// 1) Network hits to known phishing infrastructure
let PhishIoCs = dynamic(["matchyjoin.com", "joinmatchy.com"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (PhishIoCs) or RemoteUrl contains "joinmatchy.com/hollyland"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType;
// 2) Correlate with Office/email click telemetry and risky sign-ins after access
NetHits
| join kind=leftouter (
    SigninLogs
    | where TimeGenerated > ago(14d)
    | where RiskLevelDuringSignIn in ("high", "medium") or RiskEventTypes_v2 has "unfamiliarFeatures"
    | project SigninTime=TimeGenerated, UserPrincipalName, IPAddress, Location, RiskLevelDuringSignIn, AppDisplayName
) on $left.InitiatingProcessAccountName == $right.UserPrincipalName
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, UserPrincipalName, IPAddress, Location, RiskLevelDuringSignIn
| order by TimeGenerated desc;
// Standalone proxy fallback if DeviceNetworkEvents is unavailable:
// CommonEventFormat or your proxy table | where DestinationHostName has_any (PhishIoCs)

# IOC Hunt: YouTube Creator Brand-Deal Phishing (matchyjoin.com / joinmatchy.com)
# Run on endpoints used by social media / marketing staff, or via your RMM fleet-wide.
$PhishDomains = @('matchyjoin.com','joinmatchy.com')
$Findings = @()

# 1) DNS client cache — evidence a host resolved the phishing infrastructure
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $n = $_.Name; $PhishDomains | ForEach-Object { $n -like "*$_*" }
}
if ($dns) { $Findings += $dns | ForEach-Object { [pscustomobject]@{Type='DNSCache'; Artifact=$_.Name; Detail=$_.Data} } }

# 2) Browser history (Chrome/Edge SQLite) — recent visits to the phishing portal
$histPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($hp in $histPaths) {
    if (Test-Path $hp) {
        $tmp = Join-Path $env:TEMP ("hist_" + [guid]::NewGuid() + ".db")
        Copy-Item $hp $tmp -Force -ErrorAction SilentlyContinue
        # Quick string sweep without SQLite dependency
        $bytes = [System.IO.File]::ReadAllText($tmp)
        foreach ($d in $PhishDomains) {
            if ($bytes -match [regex]::Escape($d)) {
                $Findings += [pscustomobject]@{Type='BrowserHistory'; Artifact=$hp; Detail="Contains reference to $d"}
            }
        }
        Remove-Item $tmp -Force -ErrorAction SilentlyContinue
    }
}

# 3) Active/recent connections to infrastructure resolving to phishing domains
foreach ($d in $PhishDomains) {
    try {
        $resolved = Resolve-DnsName $d -ErrorAction Stop | Where-Object {$_.IPAddress}
        foreach ($ip in $resolved.IPAddress) {
            $conn = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {$_.RemoteAddress -eq $ip}
            if ($conn) { $Findings += $conn | ForEach-Object { [pscustomobject]@{Type='NetConnection'; Artifact=$ip; Detail=("PID " + $_.OwningProcess + " / " + (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName)} } }
        }
    } catch {}
}

if ($Findings) {
    Write-Host "[!] POTENTIAL PHISHING EXPOSURE DETECTED:" -ForegroundColor Red
    $Findings | Format-Table -AutoSize
    Write-Host "[!] ACTION: Force sign-out of all Google sessions for affected users, revoke OAuth grants, rotate credentials, verify recovery email/phone and MFA on Google + YouTube channel accounts." -ForegroundColor Yellow
} else {
    Write-Host "[+] No IOC artifacts found on this host." -ForegroundColor Green
}

Response Priorities

Immediate (0–4h):

• Block matchyjoin.com, joinmatchy.com, and the /hollyland lure path (plus wildcard the parent domains) at DNS/RPZ, secure web gateway, and email gateway layers.
• Hunt proxy, DNS, and browser telemetry for any access to these domains in the last 14–30 days; pivot to urlscan.io/VT for sibling infrastructure and block preemptively.
• Sweep inbound mail for sponsorship/collaboration lures mentioning Hollyland, Nike, or Spotify linking to non-corporate domains.

Within 24h (identity-critical):

• This is a credential/session theft campaign — treat any user who visited the phishing portal as compromised until proven otherwise. Force global sign-out of all Google sessions, revoke third-party OAuth grants and app passwords, and rotate credentials.
• Verify recovery email, recovery phone, 2SV/MFA configuration, and channel manager/permission lists on all corporate YouTube channels and associated Google accounts — attackers persist via recovery-artifact changes, not malware.
• Review sign-in logs for unfamiliar devices, ASNs, or impossible-travel events against marketing/social-media staff accounts.

Within 1 week (hardening):

• Enforce phishing-resistant MFA (FIDO2/passkeys) on all Google accounts that manage brand channels; session-token theft defeats SMS/TOTP.
• Restrict YouTube channel management to dedicated, monitored accounts; remove creator/manager roles from daily-driver inboxes where feasible.
• Deploy a brand-impersonation and lookalike-domain monitoring capability (the kit rotates domains per brand lure), and add sponsorship-lure scenarios to phishing simulation training for marketing and creator-facing staff.
• Establish an out-of-band verification procedure: any inbound brand deal must be confirmed via the brand's official corporate domain before any SSO or "platform signup" link is clicked.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub