Cybercrime Thrives During IPL 2026: A Season of Scams and Identity Theft

Post Views: 3

Buy Tickets Only Through Official Channels: The Case of Industrialized Cricket-Themed Frauds

In recent years, the Indian Premier League (IPL) has become a prime target for cybercriminals, exploiting fans’ enthusiasm and naivety. A sprawling, industrialized scam ecosystem has emerged, leveraging fan emotions, exploiting the urgency of sold-out matches, and delivering malware to thousands of devices under the guise of free live streams.

The Scope of the Scam

Researchers at CloudSEK discovered over 600 fraudulent domains selling fake IPL tickets
More than 400 fake streaming websites were found, serving as malware delivery systems
The scam is not just limited to stealing money; it also drains bank accounts, browser sessions, and even cryptocurrency wallets

How the Scam Operates

The scam typically starts with a convincing advertisement, often appearing as a social media post or a message forwarded through a messaging app. The ad promises last-minute pavilion seats for a big match and directs the victim to a website that looks authentic, complete with team logos, a countdown timer, and a warning about available seats. The victim pays via UPI or card and receives a PDF with a scannable QR code. However, when they attempt to enter the stadium with the QR code, they are turned away.

According to CloudSEK’s researchers, “The admin backend of one of these fake ticketing operations revealed a sophisticated setup designed for scale, tracking bookings in real-time, storing victim names, phone numbers, and IDs, and allowing operators to manually verify incoming UPI payments before dispatching fake tickets.”

Streaming Fraud Prey on Fans

Over 400 fake streaming sites were optimized specifically for high-intent searches
These sites looked convincingly real, featuring match listings, team names, streaming buttons, and navigation menus
However, when a visitor clicked play, the real operation began, and the site redirected them to a device-specific trap, often infecting their device with malware

The Malware

SHub Stealer, a macOS infostealer, is a type of malware designed to operate quietly in the background while systematically looting everything of value from an infected machine. It harvests:

macOS login passwords
Browser passwords and cookies
Chrome master password data
Telegram Desktop sessions
Apple Keychain data
iCloud credentials
Safari cookies, history, and autofill data
Apple Notes databases
Files from the Desktop and Documents folders

For cryptocurrency holders, the threat is existential, as SHub Stealer targets data from over 100 crypto wallet browser extensions and desktop wallets. In some cases, the malware modifies application files to capture wallet seed phrases, granting irreversible access to a victim’s funds.

Avoiding the Scam

To avoid falling victim to these industrialized cricket-themed frauds, it is essential to buy tickets only through official channels, such as the BCCI website or its authorized partners. Be cautious of any ticket offer surfacing through social media, a messaging app, or an unfamiliar website, and only use authorized broadcast platforms for streaming.