YouTube Channel Theft: How Fake Endorsement Scams Work

An endorsement offer by email can be a genuine business opportunity for a YouTube creator, but it can also be a way for scammers to steal a YouTube channel. Attackers may impersonate a brand or marketing agency, ask the creator to open a partnership document, run a demonstration program or sign in on a fake website. If the file contains malware or account access is surrendered, the attacker may take over the channel, alter its profile and publish fraudulent content.

This article combines my original experience receiving a suspicious partnership email targeting the Catperku channel with practical account-security guidance. The original screenshot and investigation video remain available below. A third-party JavaScript snippet referenced in an older version is intentionally not loaded or embedded, because it does not help readers and could introduce unnecessary security risk.

How fake endorsement scams can steal YouTube accounts

Scammers frequently contact creators through email, social media or messaging apps while claiming to represent a brand. They offer payment and attach an alleged contract, ZIP archive, media kit application or login form. The danger arises when an attachment installs malicious software, a fake page captures credentials or the creator reveals a verification code.

Established channels are attractive targets because their audiences and business relationships have value. Smaller channels can be affected too. Security awareness should therefore be part of professional content creation and influencer marketing, not something considered only after an incident.

Warning signs of a suspicious sponsorship email

My experience with a suspicious endorsement proposal

In the original account, around 2020, I received a message from someone claiming to represent a potential partner and asking for an unusual set of actions. I documented it as a suspected phishing attempt against my channel, not as evidence that my account had actually been taken over.

That experience should not be interpreted as establishing the identity or wrongdoing of any person or organization whose name appeared in the old correspondence. The important lesson is how the approach worked and why the request warranted independent verification.

The original investigation video is preserved below. Names, on-screen examples and techniques reflect the time when it was recorded and are not an invitation to run unsafe code or files.

Security note: An older version of this post contained an external JavaScript embed associated with a Pastebin sample. It has been excluded from the current article. Do not download, copy or execute unknown samples on your primary computer.

How to verify whether a partnership offer really comes from a brand

1. Confirm the sender through a separate channel

Find the brand’s website and public contact details independently, then ask the organization through its official address whether it sent the proposal. Do not rely only on replying to the suspicious email or calling a phone number provided within it.

Review the agency’s portfolio, expected deliverables and whether the proposed campaign makes sense for your channel’s audience. A credible-looking email layout is not proof of authenticity.

2. Read the project scope before opening attachments

A reasonable creator proposal should explain the expected deliverables, platforms, publication dates, content rights, compensation and payment process. Compare it with normal professional proposals and legitimate direct advertising arrangements.

You should be able to discuss a brief without first installing obscure programs or transferring channel ownership. Ask for a plain-language explanation and signed terms if the offer is significant.

3. Avoid unnecessary software installation

A brand does not need a creator to run an unfamiliar executable just to read a video brief. Inspect the true file extension, download source and available security signals. Use production software from its official publisher and never disable antivirus tools to open a supposed “media kit.”

4. Do not surrender channel access for a sponsorship

You do not need to share your Google password with a sponsor. If a genuine collaboration requires management access, use YouTube’s authorized channel permissions and choose the most limited role that supports the task.

Review those permissions periodically, especially when working with outside editors, agencies or short-term campaign partners.

What to do if you have already opened a dangerous file

1. Stop using the affected device and move to a trusted one

If you suspect malware, stop sensitive account activity on the affected computer and obtain professional security support if necessary. Use a different, known-clean device to review credentials and recovery options. Repeatedly signing in on a compromised machine may expose fresh authentication sessions.

2. Recover and secure the Google Account

Follow Google’s official account recovery and security procedures. From a trusted device, update your password if appropriate, inspect recovery methods and active sessions, sign out suspicious devices, review connected third-party apps and activate strong two-step verification or passkeys.

Never give an OTP or backup code to somebody who claims to be support staff. Reach official help through independently navigated Google or YouTube pages.

3. Review the YouTube channel for unauthorized changes

YouTube explains that recovering the linked Google Account is the first step in recovering a hacked channel. Once access is restored, inspect the channel name, avatar, unfamiliar videos, settings, permissions and AdSense association. Use official assistance if attacker activity caused a suspension.

4. Preserve the timeline and evidence

Retain suspicious messages, relevant headers, URLs, security alerts and account activity records. These may help reconstruct what happened without exposing personal information to the public. If the compromised channel published scams, clearly communicate with the audience through trusted channels as appropriate.

Reducing phishing risk for creator teams and agencies

Use individual accounts and least-privilege permissions rather than shared credentials. Teach team members to recognize suspicious links, verification requests and unexpected attachments. Periodically review access, especially after a project ends.

Maintain a record of sponsor conversations and campaigns so staff can cross-check an offer with its original business contact. Compare offers against the channel’s audience, brand fit and realistic performance rather than unusually high promised fees.

Account protection preserves both the creator’s work and audience trust. A different response process applies when someone reuploads your video without taking over your account: copyright infringement and unauthorized account access are not the same issue.

Frequently asked questions about YouTube endorsement scams

1. Are all sponsorship emails dangerous?

No. Many offers are legitimate, but you should independently verify the sender and the proposed process.

2. What signals a fake endorsement?

Requests to run unknown programs, reveal verification codes or log in to suspicious domains are major warning signs.

3. Can a channel be stolen without a shared password?

Yes. Malware that steals sessions and mistakenly granted permissions can introduce risk without direct password disclosure.

4. Is opening a PDF always safe?

No. Risk depends on the document, reader software and vulnerabilities. Avoid attachments from unverified senders.

5. Does two-factor authentication stop every takeover?

No. It is a strong safeguard but does not eliminate malware, session hijacking or sophisticated phishing.

6. What if my Google Account has been hacked?

Use official recovery on a trusted device and inspect sessions, connected devices and recovery details.

7. Should I change my password using a link from a sponsor email?

No. Navigate independently to Google’s account security page.

8. How do I know if my channel was taken over?

Look for unfamiliar uploads, profile changes, permission changes and account notifications you did not authorize.

9. Can YouTube help restore access?

YouTube offers recovery guidance and support paths depending on the channel and circumstances.

10. Are video reuploading and account hijacking the same?

No. Reuploading concerns content use; hijacking concerns unauthorized account access.

11. Should an educational article embed phishing code?

Safer documentation is preferable to loading active scripts or giving execution instructions for malicious samples.

Official references

• YouTube Help — Recover a hacked channel
• Google Account Help — Secure a compromised account
• Google Account Help — Avoid and report phishing
• YouTube — Manage channel permissions

Please leave this field empty

Oh hi there 👋
It’s nice to meet you.

Sign up to receive awesome content in your inbox, every month.

We don’t spam! Read our privacy policy for more info.

Check your inbox or spam folder to confirm your subscription.