‘Free’ World Cup streams are spreading scams, not soccer

I love free stuff. (To avoid hoarding, I can only take a giveaway item if I know a specific person who wants it.) But you rarely actually get anything truly for free, especially online.

A report from security software vendor Malwarebytes recently detailed a new scam popping up as of late—so-called “free” World Cup streams. Many of them look and operate the same way, promising no paywall then slamming down ad after ad while you try to start the stream.

The danger here is particularly sneaky because so many of us are already used to the idea of advertisements in exchange for a free service. What you can’t see though is the backbone of these ads—Malwarebytes detected a malicious delivery network, the kind that pushes phony alerts about software updates, virus alerts, and verification pages or prize winnings.

Some of these notices can deposit malware on your system. Others can trick you into unwanted subscriptions. You can’t always avoid clicking on the links, either. The video player can have fake controls or hidden overlays, and if a stream is even piped through, the pirated feed likely has its own set of embedded ads and gotchas.

So is there a way to get your international football fix without coughing up any dough? Sort of. You can sign up for a trial for one of the official streaming partners like YouTube TV. Or you can use a VPN and access an official free international stream like through the BBC in the UK.

What makes these streams safe is that you can trace their source. All providers are well-known and have been around for years, if not decades, with many reputable reviews from users and in the media. And you can start free trials through these official sites. (That’s another scam to watch for—sign-ups for trials or subscriptions through unvetted third-party sites.)

This same kind of screening applies across the broader internet, too. Decent free apps, browser extensions, and services make clear how they make money, along with the terms of service. The best even state it upfront. Young companies will also explain their mission, who they are, and how they got started. Older companies will publish their long-established policies and extensive FAQs.

The fact that Malwarebytes recommends one of its free tools in its report on World Cup streaming scams is a great example of how to spot a legit free service. The company has been around a long time, during which its app built a reputation for excellent malware detection. It also has allowed free access to its app since the early days. If it can advertise its free Browser Guard extension to help combat a real cybersecurity threat, it’s a win for helping people and also familiarizing them with its software. Even if you never sign up for a paid subscription, you could end up recommending the app to someone else who does.

Of course, these days it’s entirely possible that a decent online freebie could become problematic. Software developers keep getting hacked, and popular, legitimate apps and browser extensions can end up compromised as a result. But being able to spot the immediate problem ones is a solid start.

In the news

Microsoft surprised us all this week with two moves that help owners of older PCs. One extends the life of Windows 10, while the other addresses an expiring protection for Windows. The latter update isn’t automatic for everyone, though—so check to see if your PC is fully patched.

Meanwhile, more variants of old attacks keep popping up. The WhatsApp campaign spreading malware is easily dodged, but as the latest LastPass-related breach shows, you can’t control the spread of information through third-parties.

The good

• Microsoft announced an extension of Windows 10 security updates through October 2027. Given the rising cost of new PCs, users with older hardware will stay safe from internet threats for a little while longer. And thankfully, at no real cost.

• Microsoft released a just-in-time update to its Secure Boot certificates. This threat protection for Windows computers would have expired otherwise for some older PCs. You should verify that you’re up to date by checking your Device Security setting in Windows, in case your computer still requires a manual update.

The bad

• The FCC in the US wants to require ID verification for all cellular phone plan customers. This move would enable the government to track users and make anonymity difficult for domestic violence victims, whistleblowers, journalists, and others seeking to maintain privacy. The agency is still taking comments on the proposal.

• A new WhatsApp phishing campaign targets users with messages containing malicious files, disguised as business documents. Opening the files on a Windows PC ultimately results in remote access for the attackers. As usual, don’t trust messages with unexpected attachments—contact the person directly to confirm their legitimacy.

The usual (sadly)

• Password manager LastPass suffered a “supply chain” attack—the compromise of one of its vendors. This type of attack has become increasingly more common in recent years. The company says no customer vault data is at risk, but enterprise users should monitor for phishing and social engineering attempts.

Tip of the week

Hate dealing with passwords? Try passkeys instead. This form of authentication requires no memorization—instead, you use biometrics or a PIN to authorize connection with a website through an encrypted protocol. It’s more secure than a password alone (and in some cases, the combo of password + two-factor authentication), with less management headache.

You can get started by using your phone, but if you’re concerned about storing your passkeys in the cloud, you can instead buy a hardware security key (like a YubiKey). I recommend buying at least two if you go the hardware key route, just in case you lose one.