Spam and phishing mail

World Cup: Fake Tickets, Fake Giveaways, Real Attacks

The storm of phishing and malware attacks using the theme of the World Cup continues – some months ago we registered several malicious campaigns with this theme. To diversify the attacks and attract more victims, Brazilian cybercriminals decided to invest their efforts to spread fake giveaways and fraudulent websites selling tickets for the games at very low prices, tickets that in fact do not exist.

The attacks start when a user does a simple search on Google, looking for websites selling World Cup tickets. Bad guys registered the fraudulent domain fifabr.com that is displayed among the first results as a sponsored link:

208216029

The fraudulent website offers tickets for Brazil’s games at the price $ 70,00:

208216030

Kaspersky products are blocking several fraudulent domains daily; all of them are using the theme of the World Cup. Such attacks are focused totally on Brazilian users and the messages generally use the names of local credit card, banks, and big stores, etc.

Phishing messages with fraudulent giveaways are getting common as well – some offering free tickets, cash, or even free travel:

208216031

“Congratulations, you’re the winner of a free ticket to the World Cup”

To obtain the free ticket it is necessary to put all your personal data and your credit card number on the fraudulent website:

208216032

Neymar and Fuleco are waiting for your credit card data

Some bad guys have also created a fake giveaway that is valid even after the Games:

208216033

“We’re giving prizes After the World Cup” just another phishing domain

Up until the beginning of the games many other attacks may appear – but we’re prepared to block them. Do not risk trying to buy tickets for the games at unknown sites – it is safer to buy them on the FIFA website, the online sales will restart on the 12 March 2014.

World Cup: Fake Tickets, Fake Giveaways, Real Attacks

Your email address will not be published.

 

  1. Prince Kevin Ogoo

    I will like to voluteer for the World Cup in Russia.

Reports

The SessionManager IIS backdoor

In early 2022, we investigated an IIS backdoor called SessionManager. It has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East.

APT ToddyCat

ToddyCat is a relatively new APT actor responsible for multiple sets of attacks against high-profile entities in Europe and Asia. Its main distinctive signs are two formerly unknown tools that we call ‘Samurai backdoor’ and ‘Ninja Trojan’.

WinDealer dealing on the side

We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack.

APT trends report Q1 2022

This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q1 2022.

Subscribe to our weekly e-mails

The hottest research right in your inbox