The somewhat controversial soccer world cup is upon us. As well as activity on the field, there is less sporting activity taking place within the murkier realms of the Internet.
Researchers have identified threat actors harvesting personal information and scamming World Cup fans trying to purchase merchandise. Looking into the issue for Digital Journal is Joe Gallop, Manager of Intelligent Analysis at Cofense.
Gallop explains that the scammers are connecting with the enthusiasm that a sizable number of people have for the football competition, noting: “Fans around the world have been eagerly awaiting soccer’s biggest event since 2018, but cybercriminals have used the global fanfare to take advantage of audiences with scams.”
As an example, Gallop mentions: “Cybercriminals seek to use the World Cup’s global forum to achieve a variety of ends, including financial gain, ideological promotion or surveillance or cyberespionage purposes. Phishing, as a threat vector, targets the habits, concerns, and interests of humans.”
Scammers are often adept at tapping into a collective event, notes Gallop: “Any issue currently making waves on social media is a lure option for the phishers, since it’s safe to assume that a significant percentage of the population is aware of it and potentially interested or even concerned about it. The World Cup is no exception.”
As with any cybercrime, data is key. Saya Gallop: “Threat actors will unfortunately use personally identifiable information to expose victims to future fraud and scams. It is critical to note that, even when conducting phishing campaigns that take advantage of a massive event like the World Cup, threat actors may often simply add that theme to others that are tried and true.”
Providing concrete example, Gallop cites: “The themes of account verification, overdue payment/invoice, and order confirmation are very common within phishing campaigns, and the majority of phishers won’t switch entirely from those extremely broad themes to a narrower sporting theme just for the period in which the World Cup holds attention. By combining the two, however, a threat actor can attempt to get the best of both worlds, playing on fans’ interest while still forcing a sense of urgency. Doing so probably reduces their potential victim pool, but also might increase the likelihood of success against particular users. Users should always be wary of unexpected emails that request payment or personal information.”
Consumers need to be aware that: “As phishing campaigns continue to become increasingly common, it is essential that the necessary steps are taken to protect inboxes, detect threats, and respond to attack.”
However, there are measures that can be taken to reduce risk. According to Gallop: “Adopting actionable intelligence that gives visibility into the risk factors in your network and immediately and decisively responses to phishing threats will help keep malicious actors at bay and ensure the protection of sensitive data.”
