Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave
Clicking one of these search results carries the user from the compromised website, through relay pages hosted on blogging platforms, and on to a fake live-streaming site. The destination site poses as a sports-focused streaming service and offers pages named after real matches in the actual tournament schedule. A video-player mock-up on the page makes it look as though the match is about to start, but throughout our investigation we never saw any actual footage play.
The fake live-streaming sites have a malicious ad network (an advertising delivery network) built in, so each time the user clicks or taps the fake play button, they are redirected to a different site. The destinations included account-opening pages for legitimate financial trading services and major e-commerce sites. These legitimate businesses are themselves likely unwitting victims of ad fraud, with their affiliate advertising abused through the same malicious ad network.
Some of the fake streaming sites also flash a message that “registration is required to watch,” sending users to a sign-up page. That page then harvests personal information and credit card details, or quietly enrolls victims in unrelated subscriptions that keep charging them on an ongoing basis. Whenever a major tournament, concert, or other high-profile event comes around, the attackers swap out their infrastructure and tactics and run the same fake live-streaming scam all over again.
Cybercriminals exploit whatever topics and news attract the most public attention to deceive users. Don’t take words such as “free” or “official” at face value. With a bit of calm judgment and the right security measures, they can protect their personal information and assets.
- Shoppers should buy tickets, merchandise, and other goods by navigating directly to the official website, not through links in search results or social media ads.
- When users do land on a site from a search, they should check the URL (domain) carefully. They should be wary of listings with unnatural titles, such as those stuffed with symbols.
- Viewers should watch matches through official broadcasters and video streaming services. If an unofficial site advertising “free streaming” asks them to register an account or enter credit card details, they should not comply.
- Even legitimate payments may redirect users to their card company’s page for identity verification (3-D Secure) and ask for a one-time password sent by SMS. They should check that the merchant and amount in the SMS match the purchase they are actually making. If anything looks off, such as an unfamiliar amount or merchant, they should stop without entering the code and contact their card company or bank.
- Users should use a different password for each service. If they reuse the same password across multiple services, a single password entered into a fake site can lead to the takeover of their other accounts.
- Installing trusted security software, and making use of its advanced anti-scam features, is another effective safeguard.
Trend Micro ScamCheck, a mobile app dedicated to scam protection, combines several AI technologies to protect users from increasingly sophisticated scams.
Its Web Threat Protection feature blocks access to malicious websites, including fake and scam sites. Its Scam Check feature uses generative AI to assess scams for users: from a screenshot of a suspicious email, advertisement, or social media post, it can determine whether a scam site is likely involved. For PC users, the same Web Threat Protection feature is built into Trend Micro Maximum Security.
TrendAI™’ security products help stop constantly evolving, increasingly sophisticated scams before they cause harm, letting defenders move toward proactive, AI-powered security.
- Shingo Matsugaya (TrendLife Threat Research)
- Makoto Shimamura (TrendLife Threat Research)
About Author
