Spam and phishing mail

World Cup: Fake Tickets, Fake Giveaways, Real Attacks

The storm of phishing and malware attacks using the theme of the World Cup continues – some months ago we registered several malicious campaigns with this theme. To diversify the attacks and attract more victims, Brazilian cybercriminals decided to invest their efforts to spread fake giveaways and fraudulent websites selling tickets for the games at very low prices, tickets that in fact do not exist.

The attacks start when a user does a simple search on Google, looking for websites selling World Cup tickets. Bad guys registered the fraudulent domain fifabr.com that is displayed among the first results as a sponsored link:

208216029

The fraudulent website offers tickets for Brazil’s games at the price $ 70,00:

208216030

Kaspersky products are blocking several fraudulent domains daily; all of them are using the theme of the World Cup. Such attacks are focused totally on Brazilian users and the messages generally use the names of local credit card, banks, and big stores, etc.

Phishing messages with fraudulent giveaways are getting common as well – some offering free tickets, cash, or even free travel:

208216031

“Congratulations, you’re the winner of a free ticket to the World Cup”

To obtain the free ticket it is necessary to put all your personal data and your credit card number on the fraudulent website:

208216032

Neymar and Fuleco are waiting for your credit card data

Some bad guys have also created a fake giveaway that is valid even after the Games:

208216033

“We’re giving prizes After the World Cup” just another phishing domain

Up until the beginning of the games many other attacks may appear – but we’re prepared to block them. Do not risk trying to buy tickets for the games at unknown sites – it is safer to buy them on the FIFA website, the online sales will restart on the 12 March 2014.

World Cup: Fake Tickets, Fake Giveaways, Real Attacks

Your email address will not be published. Required fields are marked *

 

  1. Prince Kevin Ogoo

    I will like to voluteer for the World Cup in Russia.

Reports

Operation TunnelSnake

A newly discovered rootkit that we dub ‘Moriya’ is used by an unknown actor to deploy passive backdoors on public facing servers, facilitating the creation of a covert C&C communication channel through which they can be silently controlled. The victims are located in Africa, South and South-East Asia.

APT trends report Q1 2021

This report highlights significant events related to advanced persistent threat (APT) activity observed in Q1 2021. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports.

The leap of a Cycldek-related threat actor

The investigation described in this article started with one such file which caught our attention due to the various improvements it brought to this well-known infection vector.

Subscribe to our weekly e-mails

The hottest research right in your inbox