Table of Contents
Kaspersky warns of phishing scams, fake ticket deals and business fraud targeting World Cup 2026 travellers and property owners
As thousands begin to prepare their travel plans for this year’s World Cup, threat actors are likewise preparing attempts in stealing, scamming or phishing travellers, as Kaspersky detected a campaign exploiting the branding of a well-known transport app, targeting users in Mexico late April 2026.
Based on the report, the interface of a fake Spanish-language website – impersonating one of the services – prompts users to enter their phone number and password in order to “claim prizes”.
However, in reality, the attackers are mimicking a trusted brand in an attempt to steal users’ credentials from those lured by the promise of a reward.
Ticket to nowhere
Some cybercriminals go “a level lower” and post their offers on the dark web. Digital experts have discovered a thread advertising such services, published on a shadow forum in March 2026.
The listings included offers for discounted airline tickets, hotel bookings and match tickets, allegedly at 20% off the original price.
These offers are designed to lure users and can be highly dangerous, ultimately resulting in victims losing their money and any services they expected to receive.
In the crosshairs
Cybercriminals are also targeting businesses and entrepreneurs at the intersection of the travel industry, which is also involved in the event. Given the high demand for short-term rentals during the tournament, property owners have become an attractive target for scams.
For example, a fake website was discovered requesting account credentials for a well-known platform. In this way, scammers attempt to gain access to property owner accounts, potentially resulting in unauthorised withdrawals and financial losses.
To avoid falling to such threats, users are advised to:
- Check the authenticity of websites before entering personal data. Double-check URL formats and organisations’ name spellings.
- Always choose official and reputable ticket platforms to protect your personal data from theft and misuse.
- Double-check transport websites before filling out any information: is the URL correct? Are there any spelling errors or design bugs?
- Use a reliable security solution that identifies malicious attachments and blocks phishing links.
- Enable multi-factor authentication and monitor accounts: Activate 2FA on IDs and financial apps, and regularly review statements for unauthorised activity.
READ MORE
Gen Z drives AI search trends in Southeast Asia
Google Gemini blocks 99% of bad ads in 2025
Malaysia gaming cyberthreats huge 21% rise among youth
Hallucinations in AI: how to be certain
