How the Attack Works\nSecurity researchers at Unit42 have uncovered a phishing campaign exploiting hype around the 2026 FIFA World Cup to steal personal information and payment card details. The attack begins with an email that passes standard authentication checks, allowing it to bypass spam filters. The message promises a World Cup related prize or giveaway. Clicking the embedded link triggers a chain of redirects instead of leading directly to a fake page. This multi-step process is designed to evade automated security scanners and delay detection.\n\n## Geo Cloaking and the Final Trap\nThe redirect chain ends at a geo cloaked page that changes what content is shown based on the visitor’s location. People in regions with high World Cup interest are funneled toward a fake reward checkout form. The page asks for name, home address, and full payment card details to claim the prize. All submitted data goes to the attackers. The selective targeting helps the campaign stay under the radar of researchers scanning from other regions.\n\n## Protecting Against the Scam\nFans should treat any unsolicited email offering World Cup tickets, merchandise, or cash prizes with suspicion, especially if it requests payment card information. Legitimate giveaways rarely require credit card details. Typing known website addresses directly into a browser and closely inspecting sender addresses and link domains can prevent falling victim. Anyone who has entered payment information on a suspicious page should contact their card issuer immediately and report the phishing email to their security team or a fraud reporting service.
Source: Cyber Security News
