Spam and phishing mail

World Cup: Fake Tickets, Fake Giveaways, Real Attacks

The storm of phishing and malware attacks using the theme of the World Cup continues – some months ago we registered several malicious campaigns with this theme. To diversify the attacks and attract more victims, Brazilian cybercriminals decided to invest their efforts to spread fake giveaways and fraudulent websites selling tickets for the games at very low prices, tickets that in fact do not exist.

The attacks start when a user does a simple search on Google, looking for websites selling World Cup tickets. Bad guys registered the fraudulent domain fifabr.com that is displayed among the first results as a sponsored link:

208216029

The fraudulent website offers tickets for Brazil’s games at the price $ 70,00:

208216030

Kaspersky products are blocking several fraudulent domains daily; all of them are using the theme of the World Cup. Such attacks are focused totally on Brazilian users and the messages generally use the names of local credit card, banks, and big stores, etc.

Phishing messages with fraudulent giveaways are getting common as well – some offering free tickets, cash, or even free travel:

208216031

“Congratulations, you’re the winner of a free ticket to the World Cup”

To obtain the free ticket it is necessary to put all your personal data and your credit card number on the fraudulent website:

208216032

Neymar and Fuleco are waiting for your credit card data

Some bad guys have also created a fake giveaway that is valid even after the Games:

208216033

“We’re giving prizes After the World Cup” just another phishing domain

Up until the beginning of the games many other attacks may appear – but we’re prepared to block them. Do not risk trying to buy tickets for the games at unknown sites – it is safer to buy them on the FIFA website, the online sales will restart on the 12 March 2014.

World Cup: Fake Tickets, Fake Giveaways, Real Attacks

Your email address will not be published. Required fields are marked *

 

  1. Prince Kevin Ogoo

    I will like to voluteer for the World Cup in Russia.

Reports

Lazarus targets defense industry with ThreatNeedle

In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns.

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Lazarus covets COVID-19-related intelligence

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

Sunburst: connecting the dots in the DNS requests

We matched private and public DNS data for the SUNBURST-malware root C2 domain with the CNAME records, to identify who was targeted for further exploitation. In total, we analyzed 1722 DNS records, leading to 1026 unique target name parts and 964 unique UIDs.

Subscribe to our weekly e-mails

The hottest research right in your inbox