{ "intelligence": { "actors": [], "attack_details": { "coverage": "source-limited", "registry_sha256": "d387d26963697ce866f833b1fe904fc1cd646799e06f371c8d2a2840235e7430", "schema_version": 1, "source_paragraphs": 33, "sources": [ { "document_sha256": "09721af959f70451b5bcf4360be058b42c9cbf879a84f3c9e73457dcdde5fbf8", "name": "www.welivesecurity.com", "retrieved_at": "2026-10-19T12:19:23.038164+00:00", "role": "primary", "source_id": "primary", "url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/" } ], "steps": [ { "date": "", "relation": "incident-step", "source_id": "primary", "text": "Les courriels sont personnalisés et adressés à des créateurs spécifiques dans divers pays, notamment au Pérou, au Japon et parmi les créateurs anglophones." } ] }, "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 3, "direct_entities": 14, "direct_relationships": 8, "invalid_iocs": 0, "iocs": 3, "mentioned": 8, "mitre_associated": 0, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 0, "excluded_graph_objects": 2, "graph_complete": true, "graph_objects": 14, "graph_relationships": 8, "mitre_context_complete": true, "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "status_as_of": "2026-10-19T12:17:42+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.111Z", "modified": "2026-01-18T14:36:09.339Z", "updated_at": "2026-01-18T14:36:09.339Z" }, "description_available": false, "entity_type": "Region", "id": "0584d53c-836c-41a4-a732-0edcc5dea653", "is_inferred": false, "labels": [], "lang": "en", "name": "Americas", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "location--bce21a59-810c-5c81-863c-23546cb0d6a0", "type": "Region" }, { "__typename": "Sector", "aliases": [ "Communications", "Telecom", "Telecommunication", "Telecoms" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.395Z", "created_at": "2026-01-18T14:35:13.791Z", "modified": "2026-03-01T15:18:16.401Z", "updated_at": "2026-03-01T15:18:16.401Z" }, "description_available": true, "entity_type": "Sector", "id": "08257c10-e1ae-4471-bc3f-251792c1126c", "is_inferred": false, "labels": [], "lang": "en", "name": "Telecommunications", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "identity--4b68fb1a-ff8b-5bef-8d2a-0e477b3ad78e", "type": "Sector" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.463Z", "modified": "2026-01-18T14:36:10.115Z", "updated_at": "2026-01-18T14:36:10.115Z" }, "description_available": false, "entity_type": "Region", "id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "is_inferred": false, "labels": [], "lang": "en", "name": "Latin America and the Caribbean", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "location--db71adf6-45c4-561f-9509-e84092ca174d", "type": "Region" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-12T23:39:33.112Z", "updated_at": "2026-10-12T23:39:33.319Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "1d6e6a4d-a414-4672-b7ed-2919017e8af5", "is_inferred": false, "labels": [ "brand impersonation", "credential theft", "google account compromise", "phishing campaign", "social engineering", "sponsorship scam", "sso abuse", "youtube creators" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "domain-name--981eaac3-edf8-5f31-85ac-7964fbdab511", "type": "DomainName" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-12T23:39:34.229Z", "updated_at": "2026-10-12T23:39:35.882Z" }, "description_available": false, "entity_type": "Url", "id": "27b856eb-2b73-4062-85a5-b95dad1c7d30", "is_inferred": false, "labels": [ "brand impersonation", "credential theft", "google account compromise", "phishing campaign", "social engineering", "sponsorship scam", "sso abuse", "youtube creators" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "url--19249ab0-0d0c-5b22-b1f7-1fcb140d1761", "type": "Url" }, { "__typename": "Sector", "aliases": [ "Journalism", "Journalists", "Media", "News", "News & Media", "News Media" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.396Z", "created_at": "2026-01-18T14:35:14.445Z", "modified": "2026-01-23T15:53:18.629Z", "updated_at": "2026-01-23T15:53:18.629Z" }, "description_available": true, "entity_type": "Sector", "id": "35326f4b-82da-4ede-b2b4-15a9b72da788", "is_inferred": false, "labels": [], "lang": "en", "name": "Medias and audiovisual", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "identity--b3dace8e-212d-52f3-b960-beba12893601", "type": "Sector" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:36:27.648Z", "modified": "2026-01-18T14:36:28.240Z", "updated_at": "2026-01-18T14:36:28.240Z" }, "description_available": false, "entity_type": "Region", "id": "5e22af61-1616-46dc-b076-551e7f99593f", "is_inferred": false, "labels": [], "lang": "en", "name": "Eastern Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "location--c5a2d626-2be3-5cee-b643-773a32d19ce0", "type": "Region" }, { "__typename": "Country", "aliases": [ "PE", "PER" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.030Z", "created_at": "2026-01-18T14:36:23.821Z", "modified": "2026-02-26T19:07:00.213Z", "updated_at": "2026-02-26T19:07:00.213Z" }, "description_available": false, "entity_type": "Country", "id": "6104b949-fa15-422e-8e7d-d9ebe64b767a", "is_inferred": false, "labels": [], "lang": "en", "name": "Peru", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "location--41197ce6-16b9-53c2-a07d-873624c8b8d8", "type": "Country" }, { "__typename": "Country", "aliases": [ "JP", "JPN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:36:28.776Z", "modified": "2026-01-25T16:24:47.859Z", "updated_at": "2026-01-25T16:24:47.859Z" }, "description_available": false, "entity_type": "Country", "id": "7a370bce-880b-477d-b87c-2fc78164dde9", "is_inferred": false, "labels": [], "lang": "en", "name": "Japan", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "location--5c26fa61-1bce-5286-900c-9ac7d4d93276", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-12T23:33:34.230Z", "created_at": "2026-10-12T23:39:36.670Z", "modified": "2026-10-12T23:39:40.653Z", "updated_at": "2026-10-12T23:39:40.653Z" }, "description_available": false, "entity_type": "Indicator", "id": "7bb0b1e4-be2d-4d4a-a2a3-4739c9c3a78c", "is_inferred": false, "labels": [ "brand impersonation", "credential theft", "google account compromise", "phishing campaign", "social engineering", "sponsorship scam", "sso abuse", "youtube creators" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "indicator--8247c145-64f4-5d35-b5c8-9da00f60d766", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:36:26.119Z", "modified": "2026-01-18T14:36:26.275Z", "updated_at": "2026-01-18T14:36:26.275Z" }, "description_available": false, "entity_type": "Region", "id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "is_inferred": false, "labels": [], "lang": "en", "name": "Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "location--68241bf7-96c8-5542-b488-3b8fe8f51aff", "type": "Region" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-12T23:33:34.227Z", "created_at": "2026-10-12T23:39:34.267Z", "modified": "2026-10-12T23:39:38.299Z", "updated_at": "2026-10-12T23:39:38.299Z" }, "description_available": false, "entity_type": "Indicator", "id": "a16c9200-127d-403b-af5c-20f98e3f7a84", "is_inferred": false, "labels": [ "brand impersonation", "credential theft", "google account compromise", "phishing campaign", "social engineering", "sponsorship scam", "sso abuse", "youtube creators" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "indicator--ab7dd78a-a898-5538-a97a-2b0807ea42cb", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-12T23:39:33.056Z", "updated_at": "2026-10-12T23:39:33.221Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "dc0cdb2c-5efb-4c3d-b123-d2fdc2f710f8", "is_inferred": false, "labels": [ "brand impersonation", "credential theft", "google account compromise", "phishing campaign", "social engineering", "sponsorship scam", "sso abuse", "youtube creators" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "domain-name--3877177a-0bec-50cb-b1a0-18eda146b851", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-12T23:33:34.233Z", "created_at": "2026-10-12T23:39:37.257Z", "modified": "2026-10-12T23:41:05.562Z", "updated_at": "2026-10-12T23:41:05.562Z" }, "description_available": false, "entity_type": "Indicator", "id": "f6486fb8-358c-459c-86fc-5ce8d35a886a", "is_inferred": false, "labels": [ "brand impersonation", "credential theft", "google account compromise", "phishing campaign", "social engineering", "sponsorship scam", "sso abuse", "youtube creators" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "indicator--8456366d-1643-5b29-8509-8c84ba330e55", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:37:59.735Z", "modified": "2026-01-18T14:38:00.115Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:00.115Z" }, "description_available": true, "entity_type": "located-at", "fromId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "from_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "from_name": "Latin America and the Caribbean", "from_type": "Region", "id": "1a7e18bf-4118-4428-bb9d-d97927778771", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "relationship--333d7612-4184-5ace-a7eb-618c9acd457a", "toId": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_name": "Americas", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-12T23:33:34.229Z", "created_at": "2026-10-12T23:39:37.240Z", "modified": "2026-10-12T23:39:37.446Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-12T23:39:37.446Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a16c9200-127d-403b-af5c-20f98e3f7a84", "from_id": "a16c9200-127d-403b-af5c-20f98e3f7a84", "from_name": null, "from_type": "Indicator", "id": "1e03a455-9797-46d1-8d7b-280c18660b4e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "relationship--fa4df856-0d8a-5b86-9b3a-c41973ee5d21", "toId": "dc0cdb2c-5efb-4c3d-b123-d2fdc2f710f8", "to_id": "dc0cdb2c-5efb-4c3d-b123-d2fdc2f710f8", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-12T23:33:34.232Z", "created_at": "2026-10-12T23:39:39.181Z", "modified": "2026-10-12T23:39:39.607Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-12T23:39:39.607Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7bb0b1e4-be2d-4d4a-a2a3-4739c9c3a78c", "from_id": "7bb0b1e4-be2d-4d4a-a2a3-4739c9c3a78c", "from_name": null, "from_type": "Indicator", "id": "8ad4edf9-3902-4145-9a7a-25833f59b20d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "relationship--cf003618-418d-54eb-ace9-a8eeac98ac95", "toId": "1d6e6a4d-a414-4672-b7ed-2919017e8af5", "to_id": "1d6e6a4d-a414-4672-b7ed-2919017e8af5", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:38:45.161Z", "modified": "2026-01-18T14:38:45.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:45.423Z" }, "description_available": true, "entity_type": "located-at", "fromId": "5e22af61-1616-46dc-b076-551e7f99593f", "from_id": "5e22af61-1616-46dc-b076-551e7f99593f", "from_name": "Eastern Asia", "from_type": "Region", "id": "91530847-808e-41e5-ba46-b862b581cb23", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "relationship--272b6dd8-e726-5eb2-9db7-c27916944d0f", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.030Z", "created_at": "2026-01-18T14:38:35.858Z", "modified": "2026-01-18T14:38:36.197Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:36.197Z" }, "description_available": true, "entity_type": "located-at", "fromId": "6104b949-fa15-422e-8e7d-d9ebe64b767a", "from_id": "6104b949-fa15-422e-8e7d-d9ebe64b767a", "from_name": "Peru", "from_type": "Country", "id": "a64ab93d-3107-47c7-a383-0f3c8467ddca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "relationship--066141de-32cc-5a73-8937-22b736ca5ad7", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:38:50.870Z", "modified": "2026-01-18T14:38:52.213Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:52.213Z" }, "description_available": true, "entity_type": "located-at", "fromId": "7a370bce-880b-477d-b87c-2fc78164dde9", "from_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "from_name": "Japan", "from_type": "Country", "id": "ba1c989f-7204-4e06-b9e2-1365d405256b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "relationship--0cf338f5-2612-5a1e-adb0-c70b50991dca", "toId": "5e22af61-1616-46dc-b076-551e7f99593f", "to_id": "5e22af61-1616-46dc-b076-551e7f99593f", "to_name": "Eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-12T23:33:34.234Z", "created_at": "2026-10-12T23:39:38.143Z", "modified": "2026-10-12T23:39:38.320Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-12T23:39:38.320Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f6486fb8-358c-459c-86fc-5ce8d35a886a", "from_id": "f6486fb8-358c-459c-86fc-5ce8d35a886a", "from_name": null, "from_type": "Indicator", "id": "ec6aca0b-cb56-459f-b1cf-04c6321d70b5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "relationship--eecf5aa3-8058-5d9f-8ee8-675c0ccc278c", "toId": "27b856eb-2b73-4062-85a5-b95dad1c7d30", "to_id": "27b856eb-2b73-4062-85a5-b95dad1c7d30", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.396Z", "created_at": "2026-01-18T14:35:36.366Z", "modified": "2026-01-18T14:35:36.639Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:35:36.639Z" }, "description_available": true, "entity_type": "part-of", "fromId": "35326f4b-82da-4ede-b2b4-15a9b72da788", "from_id": "35326f4b-82da-4ede-b2b4-15a9b72da788", "from_name": "Medias and audiovisual", "from_type": "Sector", "id": "fabe04e3-fc45-4bed-82c1-756010d0789b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "part-of", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "standard_id": "relationship--eab5ac18-5fd4-521d-8f2b-7e939edba774", "toId": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_id": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_name": "Telecommunications", "to_type": "Sector" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "joinmatchy[.]com", "description_available": false, "object_id": "7bb0b1e4-be2d-4d4a-a2a3-4739c9c3a78c", "object_ids": [ "1d6e6a4d-a414-4672-b7ed-2919017e8af5", "7bb0b1e4-be2d-4d4a-a2a3-4739c9c3a78c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7bb0b1e4-be2d-4d4a-a2a3-4739c9c3a78c", "valid_from": "2026-10-12T01:30:11.000Z", "valid_until": "2027-01-22T16:25:19.260Z", "validity_status": "active", "value": "joinmatchy.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "1d6e6a4d-a414-4672-b7ed-2919017e8af5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "joinmatchy.com" } ], "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "type": "domain", "valid_from": "2026-10-12T01:30:11.000Z", "valid_until": "2027-01-22T16:25:19.260Z", "validity_status": "active", "value": "joinmatchy.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "matchyjoin[.]com", "description_available": false, "object_id": "a16c9200-127d-403b-af5c-20f98e3f7a84", "object_ids": [ "a16c9200-127d-403b-af5c-20f98e3f7a84", "dc0cdb2c-5efb-4c3d-b123-d2fdc2f710f8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a16c9200-127d-403b-af5c-20f98e3f7a84", "valid_from": "2026-10-12T01:30:11.000Z", "valid_until": "2027-01-22T16:25:19.260Z", "validity_status": "active", "value": "matchyjoin.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "dc0cdb2c-5efb-4c3d-b123-d2fdc2f710f8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "matchyjoin.com" } ], "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "type": "domain", "valid_from": "2026-10-12T01:30:11.000Z", "valid_until": "2027-01-22T16:25:19.260Z", "validity_status": "active", "value": "matchyjoin.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//joinmatchy[.]com/hollyland", "description_available": false, "object_id": "f6486fb8-358c-459c-86fc-5ce8d35a886a", "object_ids": [ "27b856eb-2b73-4062-85a5-b95dad1c7d30", "f6486fb8-358c-459c-86fc-5ce8d35a886a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f6486fb8-358c-459c-86fc-5ce8d35a886a", "valid_from": "2026-10-12T01:30:11.000Z", "valid_until": "2026-11-01T07:04:50.434Z", "validity_status": "active", "value": "http://joinmatchy.com/hollyland" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "27b856eb-2b73-4062-85a5-b95dad1c7d30", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://joinmatchy.com/hollyland" } ], "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/", "type": "url", "valid_from": "2026-10-12T01:30:11.000Z", "valid_until": "2026-11-01T07:04:50.434Z", "validity_status": "active", "value": "http://joinmatchy.com/hollyland" } ], "mentioned": [ { "confidence": 100, "evidence_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "name": "Japan", "role": "mentionné", "type": "Country" }, { "confidence": 100, "evidence_id": "6104b949-fa15-422e-8e7d-d9ebe64b767a", "name": "Peru", "role": "mentionné", "type": "Country" }, { "confidence": 100, "evidence_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "name": "Americas", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "name": "Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "5e22af61-1616-46dc-b076-551e7f99593f", "name": "Eastern Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "name": "Latin America and the Caribbean", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "35326f4b-82da-4ede-b2b4-15a9b72da788", "name": "Medias and audiovisual", "role": "mentionné", "type": "Sector" }, { "confidence": 100, "evidence_id": "08257c10-e1ae-4471-bc3f-251792c1126c", "name": "Telecommunications", "role": "mentionné", "type": "Sector" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-12T01:30:11.108Z", "created_at": "2026-10-12T23:39:39.598Z", "modified": "2026-10-12T23:41:00.125Z", "published": "2026-10-12T01:30:11.108Z", "updated_at": "2026-10-12T23:41:00.125Z" }, "description_available": true, "id": "6e428033-e9dd-473c-8873-cd39bbdf46f0", "is_inferred": false, "labels": [ "brand impersonation", "credential theft", "google account compromise", "phishing campaign", "social engineering", "sponsorship scam", "sso abuse", "youtube creators" ], "lang": "en", "name": "Inside a brand deal scam targeting YouTube creators", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-10-12T01:30:11.108Z", "references": [ { "external_id": null, "id": "ac5cba96-6265-456c-8c15-0ffb5156449c", "source_name": "alien-vault", "url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/" }, { "external_id": "6acc3823ee551dd1565f0a27", "id": "a7f124d5-7232-4e1a-8417-1bf5112067bb", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6acc3823ee551dd1565f0a27" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "6e428033-e9dd-473c-8873-cd39bbdf46f0", "schema_version": 1, "selected_date": "2026-10-12", "source_url": "https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/" }