It’s 8:47 a.m. when the first Slack message lands: “Is this really our CEO’s LinkedIn?” A screenshot follows. Same headshot, same job title, same connection count built up over a decade. The only difference is a single character swapped in the profile URL, and a pinned post announcing an “employee investment pool” with a link to send funds.
By the time legal, comms, and security are all on the same call, the fake profile has already messaged forty employees and three journalists. Nothing in the security stack fired, because nothing in the security stack could see it. The whole thing played out beyond the corporate perimeter, on a platform the company doesn’t control and can’t patch.
This is the shape of a threat category most security programs still treat as a marketing problem rather than a security one: the creator economy hijack.
The New Perimeter Nobody Owns
When security teams audit digital risk, they typically look inward at email gateways, employee laptops, and firewalls. Adversaries have found a more lucrative and far less defended door into the enterprise: the high-reach social accounts, YouTube channels, and executive profiles that carry a brand’s trust without ever living behind its firewall.
Threat groups run coordinated credential harvesting and account takeover campaigns against exactly these assets. Once a channel or profile is compromised, it gets monetized fast through malware distribution, crypto drainers, and executive impersonation scams. For a CISO or CTO, the exposure here isn’t measured in leaked records. It’s measured in how quickly a trusted identity can be turned into a weapon against customers, employees, and partners.
Inside the Multi-Stage Harvesting Engine
To understand why standard controls miss this, look at the automation behind modern phishing kits. Attackers moved past static landing pages years ago. What they run today are dynamic web applications purpose-built to defeat scanners and the researchers behind them.
1. Anti-analysis and noise injection
When a threat-intel crawler or scanner hits the phishing domain, the backend fingerprints the request. Anything that looks automated gets served a decoy page stuffed with randomized JavaScript noise, which is enough to defeat signature matching and muddy sandbox analysis.
2. Victim filtering by reach
Before serving the real credential-harvesting payload, the kit queries backend endpoints to profile the visitor, often by subscriber count or engagement level. Crawlers and low-value visitors get the harmless decoy, while high-reach targets are routed into an active session. This isn’t spray-and-pray phishing. It’s precision-targeted at the accounts with the most downstream trust to exploit.
The threshold turns out to be remarkably specific. Channels above roughly three million subscribers are filtered out of the flow entirely and shown a benign message claiming no copyright issues were found, while everything below that line receives a fake copyright-strike notice pushing the victim to sign in.
Why it matters: attackers aren’t skipping the biggest channels because those accounts are worth less. They’re avoiding the extra platform protections and scrutiny that come with scale. That puts the real target zone squarely in the mid-tier range, which is precisely where most brand ambassador deals and influencer partnerships actually live.
3. Browser-in-the-Browser and live MFA relay
Instead of redirecting to a fake login page, the kit renders a pixel-perfect simulated browser window inside the DOM, complete with a fake SSL padlock and a correct-looking Google URL in the address bar. User input is proxied in real time, push-notification MFA prompts included, capturing authenticated session cookies directly. The control most programs treat as their last line of defense turns out to be relay-able in seconds, and we’ve documented the same token-theft pattern in phishing-as-a-service kits built on Evilginx-style reverse proxies.
The Technique Is Being Commoditized
This is no longer confined to custom-built criminal kits. Kuba Gretzky, creator of the widely used Evilginx adversary-simulation framework, has publicly signaled that native Browser-in-the-Browser support is coming to Evilginx Pro, including automatic detection of the victim’s OS and browser theme, a spoofable address bar, and a resizable simulated window. That feature set lines up closely with what’s already been observed in the clusters covered here.
Evilginx Pro is gated to vetted security professionals, so this isn’t a direct handoff to criminals. But offensive tooling has a long history of leaking downstream, and the capability gap between a nation-state operator and a low-tier fraudster keeps narrowing. Defenders should expect to encounter BitB far more often, and from far less sophisticated adversaries, than they might currently assume.
What This Looks Like in the Wild
Scenario A: The sponsorship trap. Adversaries approach a creator or brand ambassador with a fake sponsorship deal and a “collaboration brief” link. Within minutes of account takeover, the channel is rebranded to impersonate a known enterprise and used to broadcast fraudulent livestreams. Consumers associate the fake stream with the real brand, and the company absorbs the reputational damage and cleanup cost for an attack it never saw coming.
Scenario B: Executive profile impersonation. This is the story that opened this piece, and it’s become one of the fastest-growing vectors we track. Attackers clone an executive’s public profile on LinkedIn, X, or Instagram, sometimes down to the bio and post history, then use the borrowed credibility to run investment scams, solicit “urgent” wire transfers, or phish employees who assume the message is internal. Because the profile lives on a platform the company doesn’t own, there’s no gateway to intercept it and often no obvious owner inside the org to catch it early. We break the detection patterns down further in our guide to brand impersonation protection.
Scenario C: Executive identity theft via typosquat domains. A step further, attackers register lookalike domains matching an executive’s name or media handle, then host BitB portals there to harvest real corporate Google Workspace credentials. One compromised executive account is frequently enough for lateral movement into internal communications and cloud storage.
Where Bolster AI Fits In
Email gateways and web filters stop at the edge of corporate-managed devices. They have no visibility into a lookalike domain, a cloned executive profile, or a hijacked YouTube channel, because none of that infrastructure ever touches the corporate network.
This is the gap Bolster AI is built to close. The platform continuously monitors social media, video, and web ecosystems rather than corporate assets alone, combining domain monitoring for lookalike registrations with a dedicated social media monitoring module for cloned executive profiles and hijacked brand accounts. Visual AI does the work text-based blocklists can’t, flagging BitB popups and spoofed login pages by what they look like rather than what they say.
When a threat is confirmed, Bolster AI moves straight to automated takedown, with analysts in the loop for edge cases and contested removals. Takedown requests go out to social platforms within 60 seconds of detection, detection accuracy sits at 99.999%, and the platform has removed 98% of the executive impersonations it has ever detected. SoFi used that model to shut down an international phishing campaign in 24 hours while cutting analyst workload by 20%.
Safeguarding Digital Trust
As threat groups adopt BitB lures and anti-bot evasion, the line between personal creator security and enterprise brand protection keeps blurring. There’s no published victim count for the specific clusters described here, since researchers have documented the infrastructure and technique rather than a breach tally. The trend line around them, though, isn’t in question. Menlo Security’s 2026 browser threat research found that 1 in 5 phishing links users actually click goes completely undetected by legacy URL filtering. The same telemetry surfaced 115,842 evasive phishing attacks across active campaigns, each engineered to slip past reputation-based filters using CAPTCHA abuse, redirection chains, and HTML smuggling. That’s the same evasion logic driving the noise injection described above, running at scale.
Separately, security researchers have observed the fake-copyright-strike lure running as a shared platform used by multiple attackers at once, each targeting their own set of creators rather than a single actor working alone. Read together, that’s not the story of one campaign. It’s the story of a technique being actively commoditized and scaled.
The accounts most worth protecting are often the ones furthest from IT’s reach: the CEO’s LinkedIn, the brand’s YouTube channel, a founder’s X profile. Protecting them means extending visibility past the perimeter, to wherever the brand’s trust actually lives.
See What’s Impersonating You Right Now
Most teams are surprised by what turns up in the first scan. Request a demo and we’ll show you the fake profiles, lookalike domains, and hijacked accounts currently trading on your brand’s trust, plus how fast Bolster AI can take them down.
