Looking for a Shorter Overview?
AI Summary
Key Moments
Stor ökning av VM-relaterade cyberhot
Under VM:s höjdpunkt var antalet försök att nå skadligt innehåll nästan sex gånger högre än före turneringen.Hot kommer från företagsmiljöer
Majoriteten av de skadliga försök som blockerades härrörde från företagsnätverk via anställdas privata surfande.Tre huvudangreppsmetoder
Nätfiske, falska streamingtjänster och skadlig kod i filer var de dominerande attackteknikerna under VM.Stora evenemang lockar fortsatt cyberhot
Framtida evenemang som Bundesliga-premiären och Champions League förväntas utnyttjas i liknande attacker.An analysis by Netskope Threat Labs, based on data from over 1,000 organizations worldwide, shows that the number of users attempting to access malicious World Cup-related content was nearly six times higher during the height of the tournament than before kick-off, with the majority of attempts occurring from corporate environments.
The 2026 FIFA World Cup is over, and Netskope Threat Labs has now compiled the results of the cyber threat wave that followed the tournament. Between March and July 20, 2026, more than 28,000 World Cup-related cyber threats. The analysis covers over 1,000 organizations worldwide.
During the height of the tournament, the number of users attempting to access malicious World Cup-related content was almost six times higher than the average before kick-off. 
What was most remarkable, however, was not the number of threats, but where they originated. The attempts came from corporate environments. What was initially seen primarily as a consumer phenomenon turned out to also pose a direct threat to corporate security, through employees' private browsing in the workplace.
Three dominant attack methods
Phishing and credential theft
Attackers used fake job advertisements related to the World Cup. Job seekers were asked to log in to submit their application and were then redirected to fake video conferencing services. The aim was simply to obtain their login details.
Fake streaming services
Cybercriminals exploited the interest in free World Cup broadcasts by creating fake streaming platforms and fraudulent payment pages where users subscribed to services that never existed. The traffic came mainly from search engines, as the attackers had SEO-optimized the websites to achieve high rankings in search results.
Malicious code via files
Files that pretended to be ticket viewers or streaming helpers actually contained commercially available infostealers. The malware collected users' login credentials and other sensitive information from their devices.
The next peak in the threat landscape is already predictable
According to Netskope, developments show that major international events continue to be attractive targets for cybercriminals because a single lure can reach a global audience.
For security managers, this means that the next peak in the threat landscape is already predictable. The Bundesliga premiere, the Champions League and the year's big shopping periods in the fourth quarter are examples of events that are likely to be exploited in future attack campaigns.
Netscope therefore recommends security solutions that analyze web content in real time, instead of relying solely on block lists of already known domains.
About Netskope Threat Labs
Netskope Threat Labs is comprised of some of the industry's leading researchers in cloud-based threats and malware. The team identifies and analyzes the latest threats to enterprises and develops methods to protect organizations against them. The researchers are regular speakers and contributors to leading international security conferences, including DEF CON, Black Hat, and RSA.
Swedish 
Danish 
Norwegian 
Finnish 
English 
German 
Dutch 