High-profile events consistently attract opportunistic attackers, and the 2026 FIFA World Cup was a prime example of this trend. Because the tournament generated massive global interest and traffic, it created a perfect environment for hackers to exploit unsuspecting users. They used various techniques, from simple social engineering to complex malware delivery schemes, tailored to tap into the surge of traffic from users looking for anything related to the World Cup. Netskope observed a spike in users attempting to visit malicious content with World Cup themes corresponding to the start of the tournament and continuing through the tournament’s end. At its peak, the number of users attempting to access malicious World Cup content was nearly 6-times the pre-tournament average. Over the course of the tournament, Netskope detected and stopped more than 28,000 World Cup-themed threats spanning more than 1,000 organizations worldwide.
Examples
The following are three examples of the most common threat types throughout the tournament.
Phishing / Credential Scams
To trick users into providing their credentials, attackers used a wide range of social engineering tactics. Perhaps the most interesting were fraudulent job postings, which required victims to log in to apply and included fake pages to join a videoconference for the interview, as shown in the image below. The ultimate objective of these campaigns was to harvest account credentials.
Image 1: A fake meeting page from FIFA from a fake job hiring domain
Fake streaming websites
As fans scrambled for ways to view matches, many inevitably sought out unauthorized platforms offering free access. Adversaries capitalized on this demand by launching fake streaming portals designed to siphon traffic for secondary motives or implement deceptive payment gateways that trick enthusiasts into purchasing bogus subscriptions. Attackers successfully used SEO techniques to get their fake streaming sites listed favorably on popular search engines, which were the main drivers of traffic.
File-based malware
Attackers even spread malware that promised to help its victims secure World Cup tickets or stream the matches. The payloads were typically commodity infostealers that would harvest credentials and other sensitive data from their victim’s computers.
Conclusion
High-profile events such as the World Cup serve as a lucrative bait for attackers, because a single bait can attract a wide variety of victims across the world. Attackers use the event as bait to drive traffic to malicious websites, facilitate financial scams, and spread malware. The activities observed during the World Cup serve as a reminder to remain vigilant against offers that seem too good to be true: free tickets, free streams, dream jobs, etc. Organizations can help ensure a safer browsing experience during future high-interest global events by deploying robust security guardrails that inspect web content in real time to block potential threats.
