With the World Cup underway, the web is awash in sites promising every match live, in HD, for free, with no signup and seemingly no catch. There is a catch. Researchers at Malwarebytes found more than 40 near-identical "free stream" sites that are not really in the streaming business at all. Behind matching page templates and shared code, they are built to funnel football fans through a malicious advertising network into scams, malware, and fraudulent downloads.
One template, dozens of sites
The 40-plus sites use different World Cup themed names but run the same code and the same ad infrastructure, with a script that spins up a fresh page for every match so the operation is cheap to scale. When a video appears at all, it is usually lifted from a third-party piracy service. The real business is the wall of advertising around the player: a typical page loads eight or more ad and tracking scripts, most of them wired back to a single hub domain that Malwarebytes flags as malicious. As the researchers put it, your data is the product and the "stream" is the bait.
How the scam plays out
The pages are engineered to wring out ad views. A script hijacks your very first click anywhere on the page to open an ad in a new tab. The "Play" button leads into a maze of "Click Resume to continue" prompts, each one firing more ads, while tiny invisible one-pixel ads load in the background to rack up paid views. Often there is no working stream, just an endless "Streams loading, retry" loop. The ads themselves fall into two buckets: fake chat-message notifications ("Seen my message yet?") designed to look like alerts you forgot to check, and crypto bait pushing "play-to-earn" games, surprise airdrops, and impossible promises like a "124% APY yield engine."
How to watch safely
Stick to official broadcasters and licensed streaming services, where the legal and safe coverage lives. Treat "every match, free, HD, no signup" as a red flag, because broadcast rights are expensive and a site giving it all away is making money some other way. If a streaming page opens pop-ups, launches extra tabs, or sends you through endless "click to continue" screens, close it. Never download anything or trust a virus warning or update prompt on these sites, use a browser that blocks ad and tracker domains, and keep your software patched.
Selected indicators (defanged): freeworldcupstream[.]xyz, watchworldcupfree[.]online, worldcuplivestream[.]online, liveworldcup2026[.]xyz, worldcupstreameast[.]online.
The campaign was documented by the Malwarebytes threat intelligence team. It is the latest scam riding the tournament, after a billion-dollar fraud ecosystem mapped around the 2026 World Cup and broader malvertising campaigns abusing major ad platforms.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.