The World Cup is fast approaching, and it's inevitable that we'll see many campaigns related to this global event.

Many advertising, marketing, and promotional programs will capitalize on users' excitement and interest in the 2014 World Cup to profit. Besides legitimate marketing, advertising, and promotional emails, users may also receive emails promising anything from free match tickets to participation in raffles where the winner might receive a car.

"Doesn't this sound too good to be true?" If you're thinking that, you're right!

Scammers will seek to exploit users' excitement for the FIFA World Cup taking place this June in Brazil, and the harm that users could suffer if they become victims could be very serious.

Users not only become victims of a scam where their bank accounts may be emptied, but their computers themselves will also be infected with malware. This malware can do anything: from stealing users' personal information by downloading a Trojan, to turning infected computers into part of a botnet.

Symantec has detected and identified a series of phishing emails related to the FIFA World Cup 2014. Below are some examples of phishing emails that Symantec has detected, which contain links to malware with the following subject lines:

Sent from: Parabens Voce foi o ganhador de um Par de ingressos[email protected]

Title: FIFA Copa do Mundo 2014

The subject line of this email can be translated as:

Title: Congratulations, you've won a pair of tickets![email protected]

Sent from: FIFA World Cup 2014

The email contained malware with content related to the FIFA World Cup.

The email content can be translated as follows:

You have won a pair of tickets to the FIFA World Cup 2014 in Brazil!

Print these e-tickets and collect your physical World Cup tickets at the ticket office in your city.

Print tickets

Check the address of the ticket center in your city here.

Users are then tricked into clicking on a link to print their match tickets. However, this link leads to a malicious URL to download the eTicker.rar file, which contains an executable file called eTicket.exe.

Clicking on the link causes users to download a malicious file.

Next, a file named thanks.exe (containing the Infostealer.Bancos trojan) will be placed in the following directory on the user's computer (so that it can be run every time Windows starts):

Programs/Startup/thanks.exe

The Trojan then continues to run in the background, attempting to evade security software, stealing critical financial information, storing the stolen data, and sending it to the attacker remotely at a later time. Symantec also discovered that this malware had been adapted to target financial institutions in Brazil.

Symantec customers are well protected against these types of attacks thanks to the company's "link tracking" technology – which checks all linked websites attached to emails to detect viruses and other security threats, allowing for the precise identification of the type of malware in each URL link. The detections are then recorded so that future emails containing links to the same malware will be considered "infected" and subsequently quarantined.

Although the email template above was drafted in Portuguese and targeted at users in Brazil, it can be modified to suit other regions, countries, and languages. Because football has a global influence, emails with similar content can fall victim to scams targeting users worldwide.

Global events are highly attractive to cybercriminals because they have the potential to deceive more victims by exploiting people's interests and curiosity. Therefore, Symantec predicts that scams related to the 2014 World Cup will increase as the football tournament approaches.

Symantec advises users to be vigilant and practice protective measures such as: Be cautious when receiving emails from unknown sources, unwanted emails, or suspicious emails; Avoid clicking on links attached in these emails; Avoid opening attached files in these emails; Use the latest updated security software; Regularly update anti-spam signatures.

According to VietNam.net