Why cybercriminals are getting a kick out of World Cup streaming sites

With the FIFA World Cup currently underway in Russia, scores of football fans are trawling the internet to find streaming websites where they can watch the matches. There are a number of cybersecurity threats lurking on these websites and it is important to understand the risks you will be exposed to should you not take sufficient precautions.

Several of these sites are illegal and many are used by cybercriminals for campaigns that go beyond the traditional scams that are spread by email to compromise users' devices.

And we're not just talking about invasive advertising, which these websites are also awash with. We are referring to malicious campaigns designed to take advantage of the anxiety of many football fans who are looking for a way to watch the matches. The exposure to risks increases for these fans as their desire to view the games sometimes overrules common sense.

A simple Google search for links to watch World Cup matches produced sites with numerous threats. Below are some of the most common threats to watch out for:

Social engineering campaigns for information theft

On some of the sports streaming pages, once the user enters they are automatically redirected to other websites with social engineering campaigns that seek to trick them into stealing personal information.

The first kind of attempt consists of a supposed survey and the possibility of winning a 'prize'. This is done with the sole intention of knowing what browser is being used.

Once the user completes the survey, the possibility of winning the last available device in the day's draw is offered as a 'reward'.

In the end, the only thing that the user is asked to do is to make a minimum payment to have the 'prize' delivered. No matter how many attempts are made to enter the credit card number, the user will be met with a message telling them that the payment was not authorised. The only people who really win, however, are the people behind this campaign, as they keep the credit card details.

The second type of campaign that uses the social engineering format tries to convince the user to enter their mobile number and their personal identification document (along with other personal information), which usually ends in a subscription to a premium SMS service.

​​Malicious codes

The malicious codes embedded into video players hide add-ons or extensions that seek to be installed on the user's device with the objective of obtaining personal information.

​​Adware and annoying advertising

While Potentially Unwanted Applications (PUAs) and potentially dangerous

 applications are not associated with applications that seek to steal information from users, they can be quite annoying because of the amount of advertising they show and also because in some cases they redirect users to sites that contain more dangerous threats.

​​ Cryptocurrency miners

The main purpose of some streaming websites is cryptocurrency mining.

​This is a growing trend where sports and movie streaming sites have been used as targets with increasing frequency.

If the user does not have a security solution or browser add-on that blocks and sends alerts about this type of connection, the resources of their device will be used for cryptocurrency mining without warning.

​ ​And some miners come prepared exclusively to mine on mobile devices.

Given that all these threats are close at hand, if you do intend to watch football via streaming sites, it’s important to have a security solution in place.

The writer is a sales and marketing director at ESET Asia Pacific, an​ ​IT security software and services provider. Views are​ ​personal.

Parvinder Walia