Kaspersky spots spike in World Cup phishing scams

Attackers are impersonating World Cup partners and advertising tickets for up to ten times their face value

Malicious actors are exploiting the upcoming 2018 FIFA World Cup to conduct phishing attacks only two weeks before the tournament kicks off.

Researchers at cyber security company Kaspersky Lab have detected a spike in the number of phishing pages appearing during match ticket sales, alongside a general rise in the number of football-related spam and World Cup-themed attacks.

Advertisement - Article continues below

Detailing their observations in a report published on SecureList, Kaspersky's research hub, experts showcased examples of fake lottery win notifications, advertising spam, and emails from attackers impersonating World Cup sponsors

The most significant scam involved fraudsters posing as touts or third parties in order to sell match tickets to fans who may have missed out during general sale via official channels.

Despite a complex and security-laden process of purchasing tickets - with legitimate tickets only being offered through the FIFA website via a multi-staged process - Kaspersky suggested a massive surge in users accessing the website led to fraudsters purchasing as many as they could with the aim of advertising these for up to ten times their face value.

"With full advance payment required, there is no guarantee that fraudsters will forward the tickets," the security firm warned. "What is guaranteed, however is that the payment information used to buy the tickets will give scammers all they need to collect additional funds from the user in the future."

Advertisement - Article continues below
Advertisement - Article continues below

Scams detected largely relied on the attackers registering a series of domains combining the words 'world', 'worldcup', 'FIFA' and 'Russia', among others to feign credibility, while purchasing the cheapest SSL certificates to further dupe users. Researchers also detected a number of 'sleeper' sites being used as backups once a previous domain is blocked.

"With an event such as the World Cup, there is a high risk that football fans will pay extortionate prices - only to end up with fake tickets," warned David Mole, head of sales UK and Ireland at Kaspersky.

"Once a hacker has your payment details, it can lead to them stealing your money. We urge people to be cautious and vigilant when they buy tickets. The first step is using authorised sellers to avoid getting duped."

Further examples include 'fake lottery win' notifications, which often contain malicious attachments and a message asking the 'winner' to forward their personal details to claim their prize, and in some cases asking to pay for part of the postage or bank transfer fees. These emails, the researchers said, are primarily aimed at harvesting user data.

Advertisement - Article continues below

Fraudsters are also imitating the World Cup's partners and sponsors to exploit the fact these organisations often organise giveaways for clients. These web pages, according to Kaspersky, look convincing and employ a responsive user interface - with VISA, the tournament's commercial sponsor, being a primary target.

There is expected to be "an explosion" of phishing sites offering cheap airline tickets to host cities in Russia, the report continued, as well as fake offers from malicious actors impersonating accommodation services in the days leading up to the tournament.

The world of football is no stranger to the threat of phishing attacks, with Italian football club Lazio earlier this year suffering a high-profile attack in which 2 million (1.75m) was stolen. The Serie A team was fooled by fraudsters posing as representatives from another club demanding the final payment for a player transfer from 2014.

Scammers often use the cover of contemporary or trending subjects to conduct phishing attacks, with threat detection specialists Redscan recently uncovering the first case of hackers impersonating well-known companies to send malicious emails asking users to update their personal information in light of at-the-time imminent GDPR implementation.

Picture: Shutterstock

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now



Evasive malware threats doubled in 2019

24 Mar 2020

10 quick tips to identifying phishing emails

16 Mar 2020
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020

Best free malware removal tools 2019

2 Mar 2020

Most Popular

Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
high-performance computing (HPC)

IBM dedicates supercomputing power to coronavirus research

24 Mar 2020