Cybercriminals released 802,000 stolen accounts in one day during the World Cup group stage
More than 12 million compromised streaming accounts tied to World Cup broadcasts are circulating on the dark web, representing nearly $220 million in potential black-market sales. The findings come from HUMAN Security’s Satori Threat Intelligence team, which tracked accounts across 10 streaming services carrying tournament matches. On June 27, the final day of the group […] This story continues at The Next Web
HUMAN Security found 12M stolen streaming accounts tied to World Cup broadcasts on the dark web, worth $220M. Sellers raise prices as tournament demand grows.
More than 12 million compromised streaming accounts tied to World Cup broadcasts are circulating on the dark web, representing nearly $220 million in potential black-market sales. The findings come from HUMAN Security’s Satori Threat Intelligence team, which tracked accounts across 10 streaming services carrying tournament matches. On June 27, the final day of the group stage, threat actors released a record 802,000 accounts in a single day, generating an estimated $14.8 million in potential revenue.
The accounts were likely obtained through credential-stuffing attacks using stolen usernames and passwords already on the dark web, or through info-stealing malware that extracts credentials saved on victims’ devices. Over 4,300 fake FIFA domains and banking malware hidden in streaming apps were already targeting World Cup fans before the tournament kicked off on June 11. The stolen-account market is a separate layer of the same infrastructure, monetising credentials rather than phishing for new ones.
Fubo said it prepares for high-traffic events months in advance and monitors for suspicious geolocation patterns, such as the same account appearing in two distant locations within a short time. Fox Sports, NBC Sports, Telemundo, FIFA, YouTube TV, and DirecTV did not respond to requests for comment. Italian police seized a piracy app in May that streamed Sky, DAZN, and Netflix through hijacked real accounts , showing that credential-based piracy is a growing enforcement problem well beyond the World Cup. With Sunday’s final between Spain and Argentina expected to set another viewership record, the window for this market is closing, but the credentials will outlast the tournament.
