Darknet Listings Expose Accounts Linked to Super Bowl Vendors
Summary
DarkOwl found listings for stolen or allegedly compromised accounts, credentials, and stealer logs tied to betting, banking, and ticketing vendors associated with the Super Bowl.
Key points
- DarkOwl analysts reported finding listings for DraftKings, FanDuel, BetMGM, Truist, and StubHub accounts on darknet and Telegram sources.
- Some DraftKings stealer logs allegedly included browser session cookies, which can be used to access accounts and bypass multi-factor authentication.
- Listings also offered cracked accounts and credentials, with some Truist advertisements claiming to include personal information and account balances.
- The article describes credential stuffing and the sale or exchange of credential lists as additional ways attackers target betting accounts.
- DarkOwl warned that coordinated attacks on vendors around major events could cause financial and reputational harm; it did not report a confirmed attack on the Super Bowl itself.
Article Details
- Event Type
- Darknet threat-intelligence report on cyber risks to Super Bowl LVII vendors and related services
- Impact
- The article reports darknet listings and offers involving stolen or allegedly compromised accounts, credentials, session cookies, and personal information associated with betting apps, Truist, and StubHub. These exposures create risks of account takeover, fraud, and reputational harm. It describes risks and observed listings, not a confirmed attack against Super Bowl LVII.
Threat Actors
Malware
RaccoonStealer logs are typically harvested by threat actors using a form of malware known categorized as “info stealers,” such as Raccoon and Redline.RedLineStealer logs are typically harvested by threat actors using a form of malware known categorized as “info stealers,” such as Raccoon and Redline.
Vendors
Products
BetMGMThe below screenshot from DarkOwl Vision shows multiple listings for BetMGM accounts (in the preview window on the left), as well as a noteworthy result from the darknet carding forum, WWH Club.DraftKingsBelow is an example of a threat actor selling stealer logs for DraftKings on the darknet site Russian Market.NFL Sunday TicketNFL Sunday Ticket is a streaming package provided by exclusively by DirectTV.StubHubAs the official ticket payment system of the Super Bowl, DarkOwl analysts found numerous instances of official Super Bowl ticket vendor StubHub data on the darknet.TruistIn January 2021, the bank Truist signed a multi-year deal to be the official retail bank of the NFL.YouTube TVWhile the deal presently does not include commercial rights or give YouTube TV stake in NFL Media, negotiations are ongoing and that is expected to change.