News

Phishing remains one of the top attack vectors that hackers use to compromise accounts, steal credentials, gain remote access, and steal financial information. These email and SMS-based attacks are easy to distribute at scale and require little personalization, making them a commonly used tactic. Phishing attacks can now range from simple emails, to multi-stage campaigns that use artificial intelligence (AI) and imitate trusted brands.

For example, in a recent vishing campaign, hackers uses a phishing kit to create a custom phishing page, spoof the company’s IT help desk phone number, and contact a target! By spoofing a trusted phone number, hackers can impersonate the help desk to trick users into entering their credentials on a phishing page, while the phishing kit enables them to control what the target sees in real time.

In another campaign, hackers abused trusted services by sending phishing emails that include links to SharePoint, Google Drive, and OneDrive from compromised email addresses. These links enable hackers to deliver malicious payloads or steal credentials and can go undetected by email security systems.

What to do?

• ALWAYS exercise caution with communications from ANY senders, even those that appear to originate from legitimate platforms.
• Confirm requests from senders via contact information obtained from verified and official sources before taking action, such as clicking on links or opening attachments.
• Navigate directly to legitimate websites (instead of clicking on links embedded in emails) and verify them before submitting account credentials, providing personal or financial information, or downloading files.
• Users who submitted credit card information to suspicious webpages are advised to contact their banking institutions to report the fraudulent purchases immediately.
• Enable MFA and keep systems and browsers up to date.
• If you believe you’ve been victimized, disconnect the potentially infected device(s) from the Internet and run anti-virus/anti-malware scans.
• If sensitive information was entered, then change passwords for compromised accounts, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources, including credit freezes.
• If you are a Linden resident, then report malicious cyber activity to the Linden Police Department, as well as the NJCCIC and the FBI’s IC3.

The FIFA World Cup 2026 will span 16 venues across the United States, Mexico, and Canada, with matches running for 39 days from June 11 to July 19. MetLife Stadium in East Rutherford, New Jersey, will host eight matches, including the Tournament final.

Major international sporting events have become prime targets for cyber threat actors, as evidenced by attacks on the FIFA World Cup 2022 in Qatar, UEFA Euro 2024 in Germany, the 2024 Summer Olympics in Paris, and other past global events. Historical cyber threat activity targeting global events including (but not limited to) malware infection (including destructive wiper malware), distributed denial-of-service (DDOS) attacks, phishing campaigns, malicious mobile applications, fraudulent ticketing websites, account credential exposure, unauthorized access, ransomware attacks, Deepfake AI-generated content, disinformation campaigns, and more.

As early as August 2025, there have been a surge in domain registrations tied to the upcoming FIFA World Cup 2026. These domains, often masquerading as legitimate ticketing portals, merchandise outlets, or live-stream platforms, serve as precursors to cyber campaigns designed to harvest credentials, distribute malware, and siphon financial data.

It is likely that cyber threat activity related to the FIFA World Cup 2026 will be similar to observed activity during previous global events, with social engineering schemes, ransomware attacks, and nation-state targeting. Deepfake technology and other AI-generated content may be used to spread disinformation, cause confusion, incite panic, or attempt to exercise political influence. While the match venues are potential targets of cyber threats, threat actors may also target critical infrastructure supporting the World Cup, such as energy and water utilities, to impact the tournament or as part of a larger cyber operation.

Linden residents should be on high alert for FIFA World Cup 2026 scams, including fake ticket sales, counterfeit merchandise, and phishing attempts. Protect yourself by only using official, verified websites for any purchases or information, and never click on links from unsolicited emails or texts.