Loading story…
Kaspersky's GReAT team reported widespread wireless security weaknesses across public Wi-Fi environments in Mexico City, Guadalajara, and Monterrey after a passive wardriving assessment conducted ahead of the 2026 FIFA World Cup. The researchers recorded 84,588 signals and 69,473 unique SSIDs, finding strong standardization in ISP deployments, heavy dependence on the 2.4 GHz band, and frequent use of default or revealing SSID naming conventions, including names derived from BSSID metadata that can expose infrastructure details.
While WPA2/WPA3 was the dominant protection scheme overall, the study found that open networks remained common and that nearly half of detected access points advertised WPS, including roughly half of otherwise secured WPA2/WPA3 networks. Kaspersky warned that encryption alone does not reflect real wireless security posture because default configurations, predictable naming, and WPS exposure can aid reconnaissance and enable evil twin hotspots, credential harvesting, and man-in-the-middle attacks in dense tourist areas expected to attract World Cup visitors.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-21, Kaspersky GReAT published a passive wardriving assessment of public Wi-Fi environments in Mexico City, Guadalajara, and Monterrey ahead of the 2026 FIFA World Cup. The report documented 84,588 signals and 69,473 unique SSIDs, highlighting risks from open networks, WPS exposure, default naming, and metadata leakage.
On 2021-05-13, Securelist published an analysis of Wi-Fi networks observed in Monterrey, Mexico, detailing SSID patterns, hardware prevalence, channel usage, and encryption practices. The report highlighted widespread WEP use and warned that provider-managed sequential naming or key patterns could expose many networks to compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesecurelist.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two major Wi‑Fi weaknesses that undermined protections widely assumed to be provided by WPA2. The **KRACK** attack, discovered by Mathy Vanhoef, abused the WPA2 four-way handshake to force key reinstallation, allowing a nearby attacker to replay, decrypt, or forge traffic and in some cases hijack TCP sessions or inject malicious content. Because the flaw targeted the protocol rather than a single product, it affected home, office, and public Wi‑Fi environments across many vendors and platforms, with **Android 6.0 and Linux** described as especially exposed due to implementations that could reset encryption keys to all zeros; Windows and iOS were considered harder to exploit. Security agencies and vendors, including CERT/CC, NCSC, Microsoft, and Google, issued warnings and began releasing patches. A later disclosure, **KrØØk** (`CVE-2019-15126`), showed that unpatched **Broadcom** and **Cypress** Wi‑Fi chipsets could encrypt some packets with an all-zero key after disassociation, letting nearby attackers decrypt portions of wireless traffic. ESET said the bug affected more than **one billion devices**, including smartphones, laptops, IoT products, routers, and access points from vendors such as Amazon, Apple, Google, Samsung, Asus, Huawei, Xiaomi, and Raspberry Pi. Although KrØØk was related to KRACK, it was a distinct flaw, and both incidents reinforced the same operational guidance: changing a Wi‑Fi password does not fix protocol or chipset weaknesses, while timely firmware and OS updates, plus relying on **HTTPS**, **VPNs**, or other end-to-end encryption for sensitive activity, materially reduce exposure.
Jun 29, 2026
Recorded Future assessed the security environment for the 2026 FIFA World Cup across Canada, Mexico, and the United States and found that **Mexico’s host cities face the highest physical security risk**, while opportunistic theft is the most common threat to travelers in all three countries. The report said there was no specific credible terrorist plot tied to the tournament at the time of writing, but warned that **US-based violent extremists**, particularly Islamic State supporters, are the most likely actors to target World Cup-related soft targets such as fan zones, transit systems, and hospitality venues. It also said transnational criminal organizations in Mexico are likely to exploit the influx of visitors through theft, extortion, kidnapping, fraud, and possible disruption of transport corridors, especially after violence linked to the killing of CJNG leader **El Mencho** in Jalisco. On the cyber side, the report rated the **United States and Canada as facing very high ransomware and network intrusion risk**, while Mexico was assessed as having moderate cyber risk but elevated concerns tied to historical spyware abuse and organized crime-linked violence. Canada was described as physically low risk overall, though the report noted Ontario police were linked to possible **Paragon Graphite** spyware infrastructure and that host cities have expanded temporary surveillance measures. The assessment also warned that protests and strikes are likely across multiple host cities, with Mexico presenting the greatest likelihood of demonstrations disrupting travel and infrastructure, including prior blockades near Mexico City’s Banorte Stadium.
Jun 29, 2026
Palo Alto Networks Unit 42 warned that the **2026 FIFA World Cup** will present an unusually broad cyberattack surface because the tournament spans 16 host cities across the United States, Canada, and Mexico and will depend on temporary event networks layered onto existing stadium and municipal systems. The report said likely targets extend beyond venues to **transit, power, water, airports, emergency services, hotels, suppliers, ticketing platforms, and official digital services**, creating multiple paths for disruptive intrusions during the competition window. The assessment identified **Iran-linked actors**, including **Handala Hack Team** and **CyberAv3ngers**, as notable risks for destructive activity and **OT/PLC** targeting, while **NoName057(16)** was highlighted for politically timed **DDoS** campaigns. Unit 42 said financially motivated cybercrime is also likely to focus on hospitality and fan-facing services through ransomware and fraud, and it urged organizers and host-city partners to strengthen multi-jurisdiction coordination, harden OT environments, audit suppliers, prepare DDoS defenses, run destructive-malware exercises, and tighten identity and help-desk controls before kickoff.
Jun 29, 2026