Netskope Reports 28,000 World Cup-Themed Threats During 2026 Tournament
Summary
Netskope says it detected and blocked over 28,000 World Cup-themed threats across 1,000+ organizations in 2026. Users reaching malicious content peaked at nearly six times the pre-tournament average; lures included job scams, fake streams and infostealers.
Key points
- Netskope detected and blocked more than 28,000 World Cup-themed threats across over 1,000 organizations.
- At the peak, users attempting to access malicious World Cup content were nearly six times above the pre-tournament average.
- Phishing lures included fake job postings and interview pages designed to harvest account credentials.
- Fake streaming sites used SEO to attract visitors and promoted deceptive payment pages or bogus subscriptions.
- Commodity infostealers were distributed in files disguised as ticket or streaming tools, including a file named “WorldCup_Tickets_Viewer.”
- Netskope recommends real-time inspection of web content to help block threats during high-interest events.
Article Details
- Publisher
- Netskope
- Report Period
- March–July 20, 2026
- Scope
- World Cup-themed cyber threats observed across organizations worldwide.
- Key Statistics
- Netskope detected and stopped more than 28,000 World Cup-themed threats during the tournament.
- The threats spanned more than 1,000 organizations worldwide.
- At peak, users attempting to access malicious World Cup-themed content were nearly 6 times above the pre-tournament average.
- Recommendations
- Deploy security guardrails that inspect web content in real time to block potential threats.
- Remain vigilant about offers that seem too good to be true, including free tickets, free streams, and dream jobs.
MITRE ATT&CK
T1056 · Input CaptureFake login and interview pages were designed to capture credentials entered by victims.T1566 · PhishingAttackers used fraudulent job postings and fake interview or videoconference pages to phish users.T1583 · Acquire InfrastructureThe article describes adversaries creating fake streaming portals and job-related domains to host malicious content.