KUALA LUMPUR: Kaspersky experts have detected a cyber campaign exploiting the branding of a well-known transport mobile application to target users in Mexico ahead of the Fifa World Cup 2026.
The interface of a fake, Spanish-language website impersonates legitimate transport services, prompting users to enter their phone numbers and passwords to “claim prizes.”
In reality, the attackers are mimicking a trusted brand to steal the credentials of users lured by the promise of a reward.
In a statement today, Kaspersky noted that some cybercriminals go “a level lower” by shifting their operations to the dark web.
“Kaspersky Digital Footprint Intelligence experts discovered a thread advertising such services, published on a shadow forum in March 2026. The listings included offers for discounted airline tickets, hotel bookings, and match tickets, allegedly at 20 per cent off the original price,” the statement read.
“These offers are designed to lure users and can be highly dangerous, ultimately resulting in victims losing both their money and any services they expected to receive.”
Cybercriminals are also targetting businesses and entrepreneurs within the tourism and hospitality sectors linked to the tournament.
Given the high demand for short-term rentals during the event, property owners have become a prime target for fraudsters.
“For example, a fake website was discovered requesting account credentials for a well-known accommodation platform. In this way, scammers attempt to gain access to property owners’ accounts, potentially resulting in unauthorised withdrawals and financial losses.
“Another common scheme involves fraudsters attempting to extract money from organisations by posing as representatives of well-known airlines and offering fictitious business partnerships.
“In these emails, they claim to be launching new projects or business expansion initiatives, stating that they are actively seeking suppliers or contractors. If a company representative responds to such an offer, the scammers typically escalate the deception in a subsequent stage.”
To enhance credibility, the scammers send forged documents for completion and signature, including supplier registration forms and non-disclosure agreements.
The ultimate objective of the fraudsters in this scheme is to induce the organisation to pay a so-called “deposit,” ostensibly required to secure a priority position on a partner selection list.
According to the claims made in the fraudulent communications, this payment would later be fully refunded once the partnership is formally established. In reality, this promise is entirely deceptive; the perpetrators simply pocket the funds, and no reimbursement is ever made to the victim organisation.
“The travel sector, particularly when it intersects with major events, is a persistent target for a wide range of scams and fraudulent schemes,” said Anna Lazaricheva, senior spam analyst at Kaspersky.
“For end users, it is often difficult to distinguish at first sight between a legitimate website and a spoofed one, or between genuine marketing communications from a reputable service and scam emails. We therefore advise treating overly attractive offers with a high degree of caution in order to protect your personal data and financial resources.”
To avoid falling victim to such threats, Kaspersky advises users to:
Check the authenticity of websites before entering personal data. Double-check URL formats and the spelling of organisation names.
Always choose official and reputable ticket platforms to protect personal data from theft and misuse.
Verify transport websites before filling out any information, checking for correct URLs, spelling errors, or design flaws.
Use a reliable security solution that identifies malicious attachments and blocks phishing links. To ensure advanced cyber protection against increasingly complex phishing threats, Kaspersky actively amplifies its consumer solutions with AI-powered scam protection. In 2025, Kaspersky Premium once again received the annual ‘Approved’ certification in anti-phishing tests by the leading testing lab AV-Comparatives.
Enable multi-factor authentication and monitor accounts. Activate two-factor authentication (2FA) on personal IDs and financial apps, and regularly review statements for unauthorised activity.
