Cybercriminals are exploiting the World Cup frenzy to steal streaming credentials and target crypto wallets, according to a new report from HUMAN Security. The firm says it has identified 12 million stolen streaming accounts linked to the surge, with 802,000 of those detected in June 2026 alone. Banking trojans are also being used to go after crypto holders, making this a multi-pronged threat.
12 million accounts and counting
HUMAN Security's data shows the scale of credential theft tied to the World Cup is enormous. The 12 million figure covers the entire campaign so far, but the pace picked up in June, when the firm logged 802,000 stolen streaming accounts in a single month. That's a lot of logins and passwords floating around on dark web markets — and a lot of potential for account takeovers on platforms like Netflix, Disney+, and others.
Trojans pivot to crypto
The report also notes that banking trojans are being deployed to target crypto wallet holders in this wave. That's a shift from the usual focus on bank accounts. The malware is designed to steal credentials and private keys, giving attackers direct access to funds. For crypto users, that means a compromised device could drain a wallet before they even notice.
World Cup threat still growing
With the World Cup in full swing, HUMAN Security warns the cybercrime wave is likely to continue as the tournament progresses. The combination of stolen streaming accounts — often used for credential stuffing attacks — and targeted malware creates a dangerous environment. Users should treat any unsolicited links or downloads with extreme caution, especially if they involve World Cup-related content.
