The cybersecurity of the Argentine Football Association (AFA) has been compromised in an attack that blends cybercrime with sporting resentment. According to The Register, the incident stems from a dispute over the World Cup round-of-16 match between Argentina and Egypt, which ended in a 3-2 victory for Argentina but was contested due to refereeing and VAR decisions.
The Attack Vector: A Dormant Infostealer
Analysis by Hudson Rock revealed that access was not gained via a zero-day exploit, but through credential theft. The root of the problem dates back to September 8, 2025, when a device belonging to an AFA software developer—employed by the organization for nearly a decade—was infected with an infostealer. This type of malware is designed to exfiltrate passwords, session tokens, and browser-saved data.
AFA condemn All Boys after anti-semitic incidents at weekend game with ... — https://buenosairesherald.com/sports/afa-to-open-case-against-all-boys-after-anti-semitic-incidents-at-weekend-game-with-atlanta
From Stolen Credentials to Public Sabotage
The attackers, likely aggrieved Egyptian fans, used these credentials to infiltrate the federation's email systems. The attack manifested as mass emails sent from legitimate AFA domains, claiming Argentina "stole" the win and that the "robbery will not go unnoticed." The AFA has confirmed unauthorized access to an institutional account, warning recipients to ignore suspicious messages.
Argentine : perquisitions au siège de la fédération de football pour ... — https://lematin.ma/sports/argentine-perquisitions-au-siege-de-la-federation-de-football/335990
A Growing Trend of Digital Identity Theft
This episode highlights the danger of infostealer malware, which can remain dormant for months before being monetized or used for specific goals. As noted by Hadrian, these tools do not require advanced hacking skills, as they turn stolen credentials into real-world access. This scenario mirrors the fragility of digital supply chains, similar to the Adobe case, where the compromise of a weak link exposed the entire organization.
No comments yet. Be the first!