Attackers send YouTube creators an email that appears to be from a real service—like a VPN, photo editing app, or antivirus offering. They propose to collaborate on a standard promotional arrangement.