Wave of cyber

Digital scams looking to steal data and dollars from World Cup fans are in full force as the tournament enters week two.

As the global tournament enters its second full week in Qatar, FIFA World Cup scams are proliferating as cybercriminals aim to score big from unsuspecting fans, according to data collected by cybersecurity firm Group-IB.

As widely expected ahead of the games, scammers have set up a variety of ways to harvest personal information and steal money from people trying to buy merchandise or tickets online or searching for on-site work during the games, the researchers found.

Researchers said Tuesday they’ve identified as many as 90 potentially compromised Hayya accounts, which is the mandatory system established so World Cup attendees can enter Qatar and access tickets and other services such as transportation.

To carry out their World Cup scams, the researchers observed the attackers using info-stealing malware such as Redline and Erbium.

The researchers also identified fake merchandise and ticket websites used to steal money directly or swipe banking credentials. They also uncovered roughly 40 fake apps in the Google Play Store promising access to tickets, and at least five websites purporting to be job application forms used to harvest personal information.

In another instance, scammers impersonated an unnamed “leading Qatari petrochemical company” to goad users into filling out a survey — which asks for a range of personal information — on the chance they’ll receive a prize. Those users are then asked to share the link to the scam survey via WhatsApp to between five and 10 groups or 20 to 30 contacts.

The company shared its findings with Interpol and, with respect to the compromised fan portal accounts, the Qatar Computer Emergency Response Team.

Group-IB researchers detected more than 16,000 scam domains in the run up to the tournament, the company said Tuesday, along with “dozens” of fake social media accounts, advertisements and mobile apps targeting World Cup fans and attendees. Those findings line up with data collected by other firms, including Kaspersky and Trellix, which reported Nov. 17 a 100 percent increase in the volume of malicious emails in Arab countries from September to October.

Trellix researchers reported a range of malware families used as part of the various scams, including Qakbot, Emotet, Formbook, Remocos and QuadAgent.

World Cup 2022 cyber scams have been ongoing for at least a year. In November 2021, researchers with Kaspersky reported on roughly 11,000 scam emails detected at that point related to invites to bid on providing services for the event, or event giveaways, CNET reported at the time.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure