The offer was flattering. The file was not.

This week, while cleaning up my archive, I found a file called Marketing_Strategy_Plan.exe sitting in my Documents folder, with a few oversized .dll files next to it. I traced it back to a message from someone presenting themselves as a well-known beauty brand. They said I was perfect for a role and asked me to download a few things to get started. It looked like an opportunity. It was malware.

I am sharing this because it is a trick aimed squarely at people like us: artists, freelancers, designers and marketers. We open files from strangers all day, from briefs and decks to moodboards and contracts, so a “strategy plan” does not raise any flags. That is exactly why it works.

How the Trick Works_

The bait is always the same: recognition. A brand has noticed your work, a role fits you perfectly, a paid collaboration is waiting. The next step is a download, usually a zip file or a “document” that is really a program. Once it runs, this kind of malware typically tries to steal saved passwords, browser sessions and account access, including the social media accounts creatives depend on.

This is not new. In 2021, Google’s Threat Analysis Group described a large campaign that targeted YouTube creators with fake sponsorship offers, sending them malware disguised as software to review. The costume changes; the hook stays the same.

It is also happening right now. In 2023 the US Federal Trade Commission warned that scammers were impersonating well-known companies to recruit for fake jobs on LinkedIn and other job platforms. And in September 2026, Russpain reported fake job offers sent in the name of the Spanish beauty retailer Druni, a reminder that the brand in the message is usually a victim too.

Red Flags to Watch For_

• A real brief is a PDF, a document or a link. It is never an .exe, and never a zip with an app inside.
• Brands do not cold-send you software to “review”. If a collaboration needs a tool, they point you to the official website or app store.
• Huge, oddly named files are a warning. A 157 MB .dll next to a “strategy plan” makes no sense. Padding files to a large size is a known way to slip past some scanners.
• Check the sender, not the logo. Anyone can copy a brand name and a logo. Look at the actual email address or profile, and contact the brand through its official website if you are unsure.
• Urgency is part of the script. “The role closes today” is designed to make you click before you think.

The most dangerous file is the one that arrives wearing a compliment.

If You Are on a Mac_

A Windows .exe cannot run on a Mac by itself, which is some comfort. Do not get too comfortable, though. Mac versions of these scams exist too, often as disk images or apps that ask you to override your Mac’s security warnings. Apple explains how macOS checks apps before they open; if your Mac warns you about a file, take the warning seriously.

What I Did Next_

• Deleted the files and emptied the bin.
• Checked which apps and processes run in the background and at login.
• Let my antivirus finish a full scan; it had been quietly scanning the whole time.
• Started tightening my security: updating passwords, turning on two-factor authentication and reviewing which apps have access to my accounts.

If you think you have opened one of these files, disconnect from the internet, run a full scan, change your important passwords from a different, clean device and turn on two-factor authentication. In the Netherlands you can report the scam to the Fraudehelpdesk, and the National Cyber Security Centre has guidance on staying safe.

From the Studio_

My work is about how we navigate our online lives, and the cyber seas are starting to feel like the new Wild West. Opportunity and risk now arrive in the same inbox, dressed the same way. For creatives, whose careers often depend on saying yes to strangers, that asks for a new kind of literacy: generous with people, careful with files.

Have you had one of these “collab” offers? I would love to hear what it looked like, so others know what to look for. Share it in the comments, and pass this on to a fellow creative who says yes to everything. Stay curious, and check the file extension_

Sources and Further Reading_

• Phishing campaign targets YouTube creators with cookie theft malware, Google Threat Analysis Group (2021)
• Scammers impersonate well-known companies, recruit for fake jobs on LinkedIn and other job platforms, US Federal Trade Commission (2023)
• Fake Druni job offer lures victims with instant payouts then demands investment, Russpain (September 2026)
• Safely open apps on your Mac, Apple Support
• Fraudehelpdesk, report fraud and scams in the Netherlands
• National Cyber Security Centre (NCSC), the Netherlands
• Phishing: spot and report scam emails, texts, websites and calls, NCSC (UK)

Please note: this post is for general information and reflection only. Scams, platform rules, tools and settings change, so always do your own research using official sources before acting. Nothing here is legal, financial or professional advice. If you think your device or accounts are compromised, contact a qualified IT professional. Information was checked at the time of writing and may have changed since.

© 2026 Ingrid Sanghee Edwards / DigitalNavigatorZ. All rights reserved. The text and original photographs and videos in this post are protected by copyright and may not be reproduced, republished or used to train AI systems without written permission. Third-party images, artworks, trademarks and quotations remain the property of their respective owners and are credited where used.