DarkOwl Finds Accounts and Credentials Advertised Across Super Bowl Vendors
Summary
DarkOwl analysts report seeing accounts and credentials for betting, banking, ticketing and streaming services advertised on darknet forums and Telegram, highlighting potential account-takeover and supply-chain risks around the Super Bowl.
Key points
- DarkOwl observed Bet365 and DraftKings accounts advertised for sale, including listings claiming active balances; the article does not verify the accounts’ validity.
- The article describes DraftKings credentials appearing in the naz.API dataset and says listings also offered DraftKings logs and accounts, sometimes claiming methods to bypass multi-factor authentication.
- DarkOwl found Truist account information advertised or discussed on fraud forums and Telegram; it says the bank’s NFL relationship could create supply-chain concerns.
- The article reports listings for StubHub accounts and discussions about bypassing multi-factor authentication on StubHub and Ticketmaster.
- Accounts for YouTube TV and NFL Sunday Ticket were reportedly solicited or advertised on Telegram and darknet forums.
- The article frames exposed vendor accounts and credentials as potential phishing, account-takeover and financial-fraud risks around major sporting events.
Article Details
- Event Type
- DarkOwl analysts report darknet activity involving exposed credentials and accounts for vendors and services connected to the Super Bowl, including gambling apps, banking, ticketing, and streaming.
- Impact
- The reported activity includes accounts and credentials offered for sale, alleged access to accounts with balances, and discussions of bypassing multi-factor authentication. This creates risks of account takeover, financial fraud, and potential supply-chain exposure for organizations connected to major sporting events.
MITRE ATT&CK
Vendors
DarkOwlLast year DarkOwl analysts examined the Super Bowl’s cyber threat landscape looking at how exposed technology vendors involved in the Super Bowl appear on the darknet.Microsoft32% reported dealing with cyber incidents or harmful cyber activity.” According from a 2023 report, Microsoft warned of growing cyber-threats to sporting events.National Cyber Security CentreAccording to a 2022 report from the National Cyber Security Centre, “70% of sports organizations experience at least one cyberattack per year.
Products
Amunetvarious countries on a popular deep web forum primarily known for its corporate leaked databases called Amunet.Bet365Bet365 is a British based gambling company that has become one of the most popular gambling companies in the United States.BreachForumsA version of the naz.api leak was made available on BreachForums, on January 15, 2024.DraftKingsDraftKings is another popular betting app, below is an example a DraftKings account appearing in the naz.API database with a plaintext password.NFL Sunday TicketSince the NFL Sunday Ticket and YouTube TV showing NFL games launched, DarkOwl analysts have observed cyber criminals advertise accounts for sale as well as solicit accounts on Telegram and darknet forums.RedZoneTelegram fraudsters have targeted YouTube TV more since the merger with NFL Sunday Ticket and RedZone.StubHubAs the official ticket payment system of the Super Bowl, DarkOwl analysts found numerous instances of official Super Bowl ticket vendor StubHub data on the darknet.TelegramThis user also includes their Telegram contact info.TruistIn January 2021, the bank Truist signed a multi-year deal to be the official retail bank of the NFL.WWH ClubTruist card numbers, bank account numbers, and other account information is readily available on all major carding forums like WWH Club, AS Carding, Card Villa, as well as across thousands of Telegram fraudster channels.YouTube TVSunday Ticket + YouTube TV
Industries
BankingBanking SystemsGamblingGambling & Online Sports Betting Apps SportsAccording to a 2022 report from the National Cyber Security Centre, “70% of sports organizations experience at least one cyberattack per year.Streamingaccounts alongside listings for banks (Wells Fargo, Chase), online payment companies (PayPal, CashApp), streaming platforms (Netflix, Hulu), and really any other companies that have a large global mobile application