A supposedly lucrative partnership with Grammarly, an invitation via the well-known service Miro, and, ultimately, a professionally designed website: at first glance, the request appears entirely credible. In reality, however, it is a phishing attempt that appears to be specifically targeting YouTube creators.
The scam is well executed. The attackers use a genuine Miro invitation to build trust, and then redirect users to a fake Grammarly website. There, users are first asked to verify their YouTube channel and then to log in with their Google account. This is precisely where it gets dangerous.
In this article, we’ll show you how the phishing email is structured, how to spot the fake, and why creators in particular should be especially cautious when receiving such supposed collaboration requests.
Video
The email
Let’s start with the email – simply a standard invitation to a Miro board. It’s similar to what you’d see on other services such as Google or Microsoft Office. The idea behind using a familiar service is that it builds trust, so you’re more likely to click on it just to have a look.
The phishing page
The link in the document leads to the actual phishing page. It’s well put together and looks just like the manufacturer’s original – a good replica. What stands out is the domain in the address bar; this is where you should start to be suspicious.
Otherwise, we are now asked to enter our channel name.
Here we can enter whatever we like; the channel information will be displayed.
We then move on to the actual phishing attempt. A supposed Google login window appears. However, this is not the genuine article, but a fake copy, as evidenced by its flawed design, its embedding within the website and its non-functional buttons.
Anyone who enters their details here is effectively handing over their login credentials to the fraudsters. This would give them access to the Google account and, consequently, the YouTube channel.
Important: anyone who has entered any details here should reset their login credentials immediately.
Conclusion
This phishing scam is very cleverly constructed. Instead of an obviously fake email, it initially uses a legitimate service such as Miro. This makes the invitation appear trustworthy and increases the likelihood that you will actually click on the link it contains.
However, the unfamiliar domain should be noticeable by the time you reach the supposed Grammarly page at the very latest. The embedded Google login is also a clear warning sign. Login details should, as a general rule, only be entered on the official websites of the respective providers.
Particularly in the case of supposed partnerships, it is therefore worth checking senders, links and domains carefully. If in doubt, it is better to contact the company directly via its official website rather than following links from an invitation.
Anyone who has already entered their Google login details on such a page should change their password immediately, check for active sessions and connected apps, and, if they haven’t already done so, enable two-factor authentication.