Scammers Are Using Tonight's World Cup Final to Push Fans Into Subscription Traps

Fraud researchers are warning football fans to be cautious tonight, when Spain and Argentina meet in the World Cup final, as the tournament's closing weeks have driven a fresh wave of fake streaming sites designed to harvest payment details rather than show any football at all.

Kaspersky has tracked more than 336 fake domains posing as World Cup broadcasters, ticket sellers, or prediction contests since the tournament began, while researchers at Malwarebytes separately identified dozens of near-identical fake streaming pages sharing the same templates, code and advertising network. Zscaler's threat research team has documented a parallel spike in malicious domain registrations tied to the tournament, including cases where attackers hijacked legitimate platforms to distribute links to fake streams. Altogether, researchers have counted close to 19,000 domains referencing the tournament registered since the start of the year, a portion of them feeding phishing campaigns aimed at fans searching for tickets, merchandise, or a way to watch matches for free.

The pattern is consistent across markets: a fan searching for a free stream, or clicking a video advertising one, lands on a page styled to resemble a real broadcaster. The video appears to load, then stalls and demands registration, a phone number, or a small payment framed as a one-time access fee. From there, victims either hand over a password they've reused elsewhere, exposing other accounts to takeover, or authorize a charge that quietly renews on a recurring basis, well past whatever token amount was shown at checkout. Some versions skip the subscription entirely and push cryptocurrency payments instead, which are effectively unrecoverable once sent. Malwarebytes also found some of these sites' ad networks doubling as a delivery channel for fake virus alerts and bogus software update prompts that install malware directly.

Researchers say the tactic works because it targets urgency rather than technical naivety: someone trying to catch a match that starts within minutes is unlikely to check a domain name carefully or read a terms-of-service page. The advice from all three firms is the same — watch matches only through official, licensed broadcasters for your country or region, treat any "free" stream that still asks for payment or a password as a red flag, and never enter card or cryptocurrency payment details on a site reached through an ad or a random search result rather than a known broadcaster's own domain.