Last Friday, the highly anticipated film Spider-Man: No Way Home was released, and fans are desperate to find tickets, sold out since the pre-sale in various countries. This phenomenon has not gone unnoticed by cybercriminals, who quickly implemented a malicious campaign to deceive unsuspecting users.
A report by security firm Kaspersky warns that a cybercriminal group is taking advantage of the film’s release, creating a phishing campaign with malicious websites designed to steal sensitive information and distribute malware.
These websites are fraudulently associated with Marvel or Sony, distributors of films and cinemas, and offer the most enthusiastic fans supposed access to pre-sales, additional behind-the-scenes content and interviews with the cast, trying to attract as many users as possible:
When trying to register on these websites, users are asked to enter their bank details to purchase movie tickets and download clips of the movie; In addition to the fact that this data is obviously intercepted by hackers, the downloaded videos contain all kinds of malware variants, including adware, remote access Trojans (RAT) and information theft tools.
Tatyana Shcherbakova, a researcher at Kaspersky, mentions that hackers exploit the rush that the audience has to see the film, placing various websites throughout the network to attract a large number of users, who do not usually verify the legitimacy of online platforms.
Shcherbakova adds that an important element for the success of a phishing campaign is the hype and enthusiasm generated by the topic chosen by the threat actors, since the more attractive the campaign, the better response will be obtained from potential victims. Spider-Man: No Way Home will most likely be the biggest success at the box office since the coronavirus lockdowns began, so the fan response to this campaign was immediate.
To prevent these attacks, always remember to check the URL of any website you visit, especially if registration pages appear on these platforms and you are asked for personally identifiable information, including names, phone numbers and email addresses.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
