Trellix researchers have identified an increase in email-based phishing attacks targeting the Middle East during the lead up to the World Cup in Qatar. The number of malicious emails in October was 100% more than the month previous, and the phishing campaigns are utilizing FIFA and soccer-based themes. This tactic of theme-leveraging is very common in social engineering attacks when popular events are taking place and chances of human error are increased. The researchers identified various email themes with embedded hyperlinks, including fake alert notifications for deactivation of 2FA, fraudulent FIFA ticketing office notifications claiming payment is needed, and legal notifications discussing a fake ban by FIFA. The hyperlinks transferred the victims to custom and legitimate-looking phishing pages. Several malware families were identified from these campaigns, including Qakbot (information stealing and banking trojan), Emotet (advanced trojan), Formbook (infostealer malware), Remcos (Remote Access Software and backdoor), and QuadAgent (Powershell backdoor). CTIX analysts will continue to monitor cyber activity surrounding the World Cup, and indictors of compromise (IOCs) regarding the various campaigns identified thus far can be viewed in Trellix’s report linked below.