Loading story…
Professional sports organizations are facing sustained cyber targeting, with Darktrace reporting that 84% were targeted in the past year and 57% experienced multiple incidents. The sector has become an attractive target because disruption during live events can have immediate operational and reputational impact, while teams, leagues, venues, and partners also hold valuable fan, athlete, and commercial data. Increased digitization across stadium operations, broadcasting, ticketing, and cloud services has expanded the attack surface and heightened dependence on interconnected third parties.
Phishing emerged as a leading threat vector, with sports organizations receiving 19% more phishing emails than other sectors. Darktrace said 21% of analyzed phishing messages targeted executives or VIPs, 37% used novel AI-assisted social engineering techniques, and 84% bypassed DMARC authentication checks. The reporting also warned that supply-chain exposure through ticketing platforms, broadcasters, cloud providers, and stadium technology vendors is compounding risk for the sports sector as attackers look for ways to disrupt events, steal sensitive data, and exploit trusted business relationships.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Darktrace published a report on cyber threats facing sports organizations, stating that 84% of sports organizations were targeted in the last year and 57% experienced multiple incidents. The report also highlighted elevated phishing exposure, supply-chain risk, and operational disruption threats tied to live events.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcedarktrace.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A major sportswear brand's legitimate email domain was compromised and used to launch a large-scale phishing campaign, as observed by KnowBe4 analysts. Attackers exploited the trust associated with the brand to send polymorphic phishing emails that bypassed traditional email defenses, employing advanced social engineering tactics and frequently changing payloads to evade detection. The campaign demonstrated how attackers can move laterally within an organization, extend their reach to additional victims, and continue impersonation efforts even after the initial compromise, highlighting the persistent threat to high-profile brands. Recent research presented by Okta further underscores the ongoing risk posed by phishing attacks, revealing that even organizations with advanced security measures remain vulnerable. The study found that traditional defenses such as email gateways, endpoint protection, and user training are often insufficient to stop sophisticated phishing campaigns, with American enterprises and Office 365 users being particularly frequent targets. These findings illustrate the persistent and evolving nature of phishing threats, especially when attackers leverage compromised trusted domains to increase their success rates.
Jun 29, 2026
Recent reporting and vendor research indicate threat actors are increasingly prioritizing **identity-based intrusion paths**—notably phishing, credential theft, and **Business Email Compromise (BEC)**—over traditional vulnerability exploitation as the most common initial access vector. A Darktrace report cited by SC Media describes identity breaches as the leading entry point, alongside broader trends including accelerated breach tempo, increased automation, and “converging” tactics; it also notes exploitation can occur **before public disclosure** and that overall **CVE volume rose by 20%+ year-over-year**. Email remains a dominant delivery mechanism in these identity-first campaigns. Darktrace telemetry referenced by SC Media reported **32M+ high-confidence phishing emails** across its customer base, with many messages bypassing baseline controls (including **70% passing DMARC**), targeting executives, using **malicious QR codes**, and leveraging newly registered domains. Separately, a SOCRadar analysis frames the U.S. financial sector as a disproportionate target for phishing and dark-web activity, emphasizing AI-enabled crime, persistent BEC, and third-party/supply-chain risk, and citing metrics such as **~48% of global financial phishing activity** and **~23.5% of finance-related dark web threat activity** attributed to the U.S. market.
Jun 29, 2026
Darktrace reported that cyber intrusions in the first half of 2026 increasingly targeted **trusted relationships** rather than relying mainly on malware or direct vulnerability exploitation. The company said attackers abused cloud entitlements, SaaS accounts, email authentication, software supply chains, remote administration tools, and non-human identities, making trust itself a primary attack surface. Phishing remained effective despite defensive controls, with roughly two-thirds of phishing emails passing **DMARC** and VIP users singled out in about a quarter of campaigns, while social-engineering lures became more tailored and text-heavy. The report highlighted multiple incidents showing how trusted infrastructure is being weaponized, including a compromised SaaS account that enabled cross-layer malicious activity, supply-chain compromises involving **Axios**, **Trivy**, and **Hola VPN**, and infostealer distribution through blockchain infrastructure using malware such as **StealC**, **AMOS**, and **Phexia**. Darktrace also warned that enterprise AI adoption is expanding risk, citing LLM-generated exploitation of **React2Shell**, a compromised LLM proxy at an automation technology manufacturer, and broader exposure of sensitive data in prompts. It said attackers are moving faster as well, with a React2Shell honeypot compromised in under two hours and **BeyondTrust** exploitation observed in less than a day, while state-aligned actors linked to China, Russia, Iran, and North Korea continued using legitimate services for persistence, intelligence collection, and strategic positioning.
Aug 25, 2026