Since the FIFA World Cup 2026 kicked off on June 11, cybersecurity firm Kaspersky reported it has detected at least 336 unique domains impersonating official World Cup resources. For a once-in-four-years global event, cybercriminals are naturally interested in exploiting fan interest in match streaming and sports betting through a range of schemes designed to steal personal data and funds.
World Cup Cyberthreats Galore, Says Kaspersky
One scheme involves fraudulent websites offering free access to live World Cup broadcasts. After clicking a prompt to watch, users are directed to register and then pay a cryptocurrency fee for so-called “lifetime tournament access.” (well, that’s not exactly ‘free’, is it?) This, of course, exposes victims to both credential theft and irreversible loss of funds. Pro tip from us: if the website looks generic, such as using commonly-seen fonts (in this example, it’s a free font called “Space Grotesk” which you can get for free in Google Fonts), keep yourself on high alert.
Fraudulent betting platforms have also been observed in multiple languages. A Spanish-language site was found requesting personal details under the pretense of account creation. A similar Portuguese-language site displayed a schedule of upcoming matches and prompted users to submit personal information before participating in betting. That’s textbook example of credential theft, and it’s going to be especially vulnerable for users who reuse passwords across multiple services.
A third attack vector involves phishing emails advertising football analytics and match prediction services. One observed case targeted Australian users with emails urging recipients to pay A$200 (~RM571) for access to match winner predictions. The messages used urgent language – a common indicator of scam communications – and any payments made from this point will certainly result in financial loss with no recourse.
“Since the start of the tournament, scammers have increasingly focused on the ways fans engage with the event online, as watching matches today requires only an internet connection and a device,” says Olga Altukhova, Senior Web Content Analyst at Kaspersky. “As a result, criminal activity continues to grow, as reflected in the fraudulent websites we observe offering streaming and betting services in multiple languages.”
Kaspersky advises users to verify website authenticity before entering personal data, use official streaming platforms, and enable multi-factor authentication on financial and identity accounts. The company also recommends using a security solution capable of detecting phishing links and malicious attachments.
Pokdepinion: Stick to official channels whenever you can – it’s not worth the risk if money and personal information gets involved.
