The Fake Giveaway Trap: How CS2 Streamjacking Scams Hook Fans

Every time a big Counter-Strike tournament rolls around, a second event runs quietly alongside it, one built entirely to rob the people watching. While millions tune in for IEM and PGL Major action, scammers spin up fake "giveaway" streams designed to look like the real thing, and a steady number of fans hand over their Steam accounts before they realize what happened. This particular scam has grown into one of the most effective in the CS2 world, precisely because it borrows the credibility of people viewers already trust. Here's how it works, who's been sounding the alarm, and how to keep your inventory out of reach.

How streamjacking actually works

The scam, often called "streamjacking," starts with a stolen audience. Rather than build a channel from scratch, attackers hijack an existing YouTube account with subscribers, then strip its old branding and rebrand it to impersonate a famous pro. Security researchers at Bitdefender Labs, who mapped the operation in detail, found scammers rebuilding hijacked channels to mimic players like s1mple, NiKo, and donk during major events, then looping that player's old match footage to fake a live broadcast.

On screen, a QR code or a link promises free skins, cases, or doubled crypto if you "verify" your account. Scan the code or follow the link, log in via what appears to be Steam, and the attacker captures your session. From there, your skins can vanish in minutes, and any crypto you send in pursuit of a "double your deposit" promise goes straight into a wallet you'll never see again. To make the whole thing look busy and legitimate, the fraudsters pin fake giveaway posts in the channel's community tab and lock the comments so only their own messages show.

The timing is deliberate. These streams launch during the exact tournaments where real giveaways and sponsor promos are common, so an unexpected "prize" feels normal rather than suspicious.

The players and creators calling it out

What makes this scam notable is how loudly the community has pushed back, which gives you a useful list of trustworthy voices to follow.

Oleksandr "s1mple" Kostyliev, one of the most recognizable names in Counter-Strike, publicly pressured YouTube to act after spotting channels streaming under his name and likeness. He pointed out the obvious fix that fans keep missing: he doesn't stream on YouTube at all, so any "s1mple giveaway" there is fake by definition. His post drew a reply from YouTube's own team, and a wave of fans frustrated that the fake channels stayed live for hours regardless.

He isn't alone. Team Vitality captain Dan "apEX" Madesclaire issued a blunt scam alert on X warning that a YouTube giveaway using his name and the Vitality brand had nothing to do with him, after fans started showing up in his replies asking where their winnings were. The same playbook has been run with ZywOo, donk, and entire orgs like NAVI and FaZe, which suggests the safest assumption is simple: a famous name attached to a giveaway is a reason for more suspicion, not less.

For a closer look at the mechanics, the creator dracobane (akaHudyy) published a video investigation tracing how a pro-impersonation scam ring actually operated behind the scenes, which is worth watching if you want to see the con from the inside rather than just hear "be careful."

How to stay out of the trap

The defenses here are mostly about slowing down and verifying, since the scam depends entirely on you reacting fast to a familiar face.

• Confirm the channel is real: Before trusting any "live" stream, check whether the channel has normal uploads, recent community activity, and a verified badge. A channel that's nothing but one giveaway livestream is a clone. If a pro streams at all, confirm which platform they actually use; many, like s1mple, stream only on Twitch.

• Treat every "free skins" prompt as hostile: No legitimate giveaway requires you to log into Steam through a stream link or scan a QR code. A QR scan can hand the attacker a live session on your account, and any offer to "double" crypto you send first is always fraudulent.

• Lock the account itself: Enable the Steam Guard Mobile Authenticator rather than email or SMS codes, which can be intercepted, and review your active sessions and login history now and then so you'd notice an intruder early.

• Slow the moment down: Urgency ("only during the Major," "first 100 viewers") is the tactic, not a real constraint. A genuine prize can survive you taking five minutes to check.

Additional Security References

Additional information on these scams is available from several established sources. A security guide covers examples of Steam account and case-opening scams reported by users, while Key-Drop has published a breakdown of CS2 voting and phishing scams, including fake login techniques. Bitdefender’s streamjacking report provides a security-research perspective, explaining how compromised accounts and deceptive livestreams can be used to direct viewers to phishing pages.

These examples illustrate how streamjacking schemes can exploit trusted accounts, familiar platforms, and convincing login pages. Verifying links, account details, and login destinations before entering credentials can reduce exposure to these tactics.