Spam and phishing mail

World Cup: Fake Tickets, Fake Giveaways, Real Attacks

The storm of phishing and malware attacks using the theme of the World Cup continues – some months ago we registered several malicious campaigns with this theme. To diversify the attacks and attract more victims, Brazilian cybercriminals decided to invest their efforts to spread fake giveaways and fraudulent websites selling tickets for the games at very low prices, tickets that in fact do not exist.

The attacks start when a user does a simple search on Google, looking for websites selling World Cup tickets. Bad guys registered the fraudulent domain fifabr.com that is displayed among the first results as a sponsored link:

208216029

The fraudulent website offers tickets for Brazil’s games at the price $ 70,00:

208216030

Kaspersky products are blocking several fraudulent domains daily; all of them are using the theme of the World Cup. Such attacks are focused totally on Brazilian users and the messages generally use the names of local credit card, banks, and big stores, etc.

Phishing messages with fraudulent giveaways are getting common as well – some offering free tickets, cash, or even free travel:

208216031

“Congratulations, you’re the winner of a free ticket to the World Cup”

To obtain the free ticket it is necessary to put all your personal data and your credit card number on the fraudulent website:

208216032

Neymar and Fuleco are waiting for your credit card data

Some bad guys have also created a fake giveaway that is valid even after the Games:

208216033

“We’re giving prizes After the World Cup” just another phishing domain

Up until the beginning of the games many other attacks may appear – but we’re prepared to block them. Do not risk trying to buy tickets for the games at unknown sites – it is safer to buy them on the FIFA website, the online sales will restart on the 12 March 2014.

World Cup: Fake Tickets, Fake Giveaways, Real Attacks

Your email address will not be published. Required fields are marked *

 

  1. Prince Kevin Ogoo

    I will like to voluteer for the World Cup in Russia.

Reports

The leap of a Cycldek-related threat actor

The investigation described in this article started with one such file which caught our attention due to the various improvements it brought to this well-known infection vector.

Lazarus targets defense industry with ThreatNeedle

In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns.

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Subscribe to our weekly e-mails

The hottest research right in your inbox