Kaspersky spots spike in World Cup phishing scams

Attackers are impersonating World Cup partners and advertising tickets for up to ten times their face value

Malicious actors are exploiting the upcoming 2018 FIFA World Cup to conduct phishing attacks only two weeks before the tournament kicks off.

Researchers at cyber security company Kaspersky Lab have detected a spike in the number of phishing pages appearing during match ticket sales, alongside a general rise in the number of football-related spam and World Cup-themed attacks.

Advertisement - Article continues below

Detailing their observations in a report published on SecureList, Kaspersky's research hub, experts showcased examples of fake lottery win notifications, advertising spam, and emails from attackers impersonating World Cup sponsors

The most significant scam involved fraudsters posing as touts or third parties in order to sell match tickets to fans who may have missed out during general sale via official channels.

Despite a complex and security-laden process of purchasing tickets - with legitimate tickets only being offered through the FIFA website via a multi-staged process - Kaspersky suggested a massive surge in users accessing the website led to fraudsters purchasing as many as they could with the aim of advertising these for up to ten times their face value.

"With full advance payment required, there is no guarantee that fraudsters will forward the tickets," the security firm warned. "What is guaranteed, however is that the payment information used to buy the tickets will give scammers all they need to collect additional funds from the user in the future."

Advertisement - Article continues below
Advertisement - Article continues below

Scams detected largely relied on the attackers registering a series of domains combining the words 'world', 'worldcup', 'FIFA' and 'Russia', among others to feign credibility, while purchasing the cheapest SSL certificates to further dupe users. Researchers also detected a number of 'sleeper' sites being used as backups once a previous domain is blocked.

"With an event such as the World Cup, there is a high risk that football fans will pay extortionate prices - only to end up with fake tickets," warned David Mole, head of sales UK and Ireland at Kaspersky.

"Once a hacker has your payment details, it can lead to them stealing your money. We urge people to be cautious and vigilant when they buy tickets. The first step is using authorised sellers to avoid getting duped."

Further examples include 'fake lottery win' notifications, which often contain malicious attachments and a message asking the 'winner' to forward their personal details to claim their prize, and in some cases asking to pay for part of the postage or bank transfer fees. These emails, the researchers said, are primarily aimed at harvesting user data.

Advertisement - Article continues below

Fraudsters are also imitating the World Cup's partners and sponsors to exploit the fact these organisations often organise giveaways for clients. These web pages, according to Kaspersky, look convincing and employ a responsive user interface - with VISA, the tournament's commercial sponsor, being a primary target.

There is expected to be "an explosion" of phishing sites offering cheap airline tickets to host cities in Russia, the report continued, as well as fake offers from malicious actors impersonating accommodation services in the days leading up to the tournament.

The world of football is no stranger to the threat of phishing attacks, with Italian football club Lazio earlier this year suffering a high-profile attack in which 2 million (1.75m) was stolen. The Serie A team was fooled by fraudsters posing as representatives from another club demanding the final payment for a player transfer from 2014.

Scammers often use the cover of contemporary or trending subjects to conduct phishing attacks, with threat detection specialists Redscan recently uncovering the first case of hackers impersonating well-known companies to send malicious emails asking users to update their personal information in light of at-the-time imminent GDPR implementation.

Picture: Shutterstock

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now


Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020

Most Popular

Business operations

Nvidia overtakes Intel as most valuable US chipmaker

9 Jul 2020

How to find RAM speed, size and type

24 Jun 2020

The best server solution for your SMB

26 Jun 2020