Scammers offer streaming services, giveaways and a fake cyber currency to cash in on the Olympic Games

3 years ago 433

Kaspersky's analysis found that cybercriminals are getting extra creative with the latest campaigns designed to harvest credentials.

Kaspersky experts analyzed Olympic-related phishing attacks and found fake pages offering streaming services, tickets to events that won't have spectators, and even a fake Olympic Games virtual currency.

Olga Svistunova, a security expert at Kaspersky, said that cybercriminals always use popular sports events as bait for their attacks. Security experts recommend that security teams recognize this standard tactic and incorporate an awareness of current events into threat monitoring. Even under the unusual circumstances of this year's games, bad actors have found a way to use the event to their advantage.

"For example, this year, we discovered an interesting phishing page selling an 'Olympic Games Official Token,'" Svistiunova said. "There is no real equivalent of such a thing, that means that cybercriminals are not only faking already existing baits but also coming up with their own new sophisticated ideas."

Security experts found a website selling a virtual currency that is supposed to be a support fund for Olympic athletes. The lure is financial help for an athlete in need but there is no official Olympic token. The only person who benefits is the scammer.

SEE: Tokyo 2020 Olympics must be extra secure to avoid cyberattacks and ransomware (TechRepublic)

Kaspersky's analysis found several creative ways scammers are taking advantage of the buzz around the Olympic Games.

Streaming services for watching the games

There are no spectators this year due to the coronavirus so watching the games online is the only way to see how the competitions turn out. Kaspersky experts found various phishing pages offering streaming services for the games. The trick is that users have to register to watch. Those registration pages are phishing schemes and, "once a user enters their credentials, they might be redirected to a page that distributes different malicious files," according to Kaspersky. The scam is a double whammy, delivering malware and harvesting user credentials.

Despite the fact that there will be no live audiences this year, fraudsters are still trying to sell tickets. Kaspersky experts also discovered pages offering refunds for already purchased tickets.

Credential harvesting campaigns

Kaspersky experts also found phishing pages disguised as official Olympic websites. Scammers looking to capitalize on interest in the Olympics create fake pages that look official and connected to the International Olympic Committee. The real goal, for at least some ciste according to Kaspersky, is to collect Microsoft Services credentials.

Free gift scams

The promise of free stuff is always a popular lure and Kaspersky experts found that kind of campaign using an Olympics theme. Phishing pages offering the chance to win a free TV for watching the games. The lucky winners only have to pay the delivery fee, which is pure profit for bad actors who obviously never send the prize.

Cybersecurity Insider Newsletter

Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays