DOJ seizes 400 domains: World Cup piracy crackdown reveals massive malware threat

For cybersecurity professionals, this takedown is more than a copyright enforcement action—it's a stark reminder of how illicit streaming sites serve as distribution vectors for malware. Illicit domains often host fake plugins, malicious ads, and credential-stealing scripts, turning millions of eager sports fans into unwitting victims. With World Cup viewership at record highs, the attack surface for cybercriminals has never been larger.

The US Justice Department, in coordination with FIFA and major media rights holders NBCUniversal and Warner Bros., has seized nearly 400 internet domains that were illegally streaming live World Cup matches. The operation, announced on June 26, 2026, targeted a sprawling network of servers and domains operating across six countries: Peru, Bulgaria, Croatia, Romania, Poland, and Colombia. The takedown represents one of the largest coordinated anti-piracy actions during a global sporting event, exploiting US legal authority to disrupt copyright infringement that undermines billions of dollars in broadcasting rights. The domains offered viewers unauthorized, real-time access to the tournament, which kicked off on June 11 across the United States, Canada, and Mexico and has already set all-time attendance and viewership records.

“

The US Justice Department, in coordination with FIFA and major media rights holders NBCUniversal and Warner Bros., has seized nearly 400 internet domains that were illegally streaming live World Cup matches.

However, beyond the copyright violation, the operation carries deep cybersecurity implications. Eric Weindorf, a special agent in charge at Homeland Security Investigations, explicitly warned that illicit streaming sites expose users to malware attacks and unsecured connections that can compromise personal and financial data. This statement elevates the narrative from simple piracy to a broader public threat vector. The phenomenon of malvertising, drive-by downloads, and credential harvesting on pirate streaming portals is well documented. These sites typically rely on aggressive advertising networks or force users to install seemingly benign plugins that turn out to be infostealers. Given that the World Cup matches have drawn record TV audiences—Nielsen reported some of the most-watched programs—the pool of potential victims is enormous. Threat actors time their campaigns to exploit major events, knowing that casual viewers are less discerning than tech-savvy users and often overlook security warnings in their eagerness to watch a free stream.

The international scope of the seizure—from South America to Eastern Europe—illustrates the geographically distributed nature of modern piracy infrastructure. The DOJ worked with local authorities to seize servers and domains, indicating a sophisticated investigative effort that likely involved infiltration of the illicit streaming ecosystem, tracing payment flows, and technical fingerprinting of the infrastructure. This approach mirrors previous operations such as the takedown of the pirate IPTV service 'OTT Ocean' and domain seizures during the Tokyo Olympics. Each such operation yields intelligence that can be fed back into threat detection systems, helping security vendors and law enforcement preempt future campaigns.