Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

The Price of Fame? Celebrities Face Unique Hacking Threats

Hackers are hitting the sports industry hard on social media and luring quarantined consumers with offers of free streaming services, a new report shows.

(Image: Bits and Splits via Adobe Stock)
(Image: Bits and Splits via Adobe Stock)

While sports arenas and movie theaters have gone dark for now during the pandemic, the celebrity athletes and film stars who are so well-known because of their craft remain in the crosshairs of hackers on social media.

A new report of threat data collected over 12 months by ZeroFOX across an ecosystem of media and entertainment customers including sports teams, talent agencies, celebrities, and streaming services – reveals the kinds of unique vulnerabilities entertainment companies deal with at the hands of criminals. And the main space they are being hit is on social media, accounting for 89% of threat activity, the report reveals.

Athletic teams and sports organizations are the top targets for attack, according to ZeroFOX – specifically, celebrity sports stars. While sports only represent a small portion of entertainment, sports talent is often high-profile, with sports-related threat activity making up 63.3% of all incidents. Credential compromise, in particular, has become a pervasive problem for athletes and athletic organizations.

"One of the biggest examples of this we have seen in the last year was the NFL compromise," says Ashlee Benge, senior threat researcher at ZeroFOX. "There has been a rash of lower-echelon hacking teams that target high-profile accounts. With these kinds of attacks, it is often less of a typical compromise and more of a drive-by graffiti of these accounts."

In the event Benge refers to from January, at least 15 NFL team Twitter accounts and the league's own official account, @NFL, were hacked. In many cases, the accounts were altered by removing the profile picture, Twitter header, and Twitter name. Some also had a tweet claiming to come from a group called OurMine.

"Hi, we're back (OurMine). We are here to Show (sic) that everything is hackable," the tweet read.

Benge says the best way to secure high-profile accounts (or any secure account) – and one that she advises given the opportunity for hackers to access celebrity accounts is huge now – is with multifactor authentication.

"It's a much larger attack surface in years prior where print media was the primary source of promotion," Benge says. "But it's a double-edged sword. If you choose not to use [social media], you really reduce brand awareness in a lot of ways."

According to the report, other top attack tactics targeting media and entertainment include impersonations (7.3%), compromised credentials and personally identifiable information (PII) (1.4%), cyberattack chatter (5.2%), and pirated content/counterfeit goods (6%).

The top concern for those seeking to combat criminal activity is on protecting high-profile individuals – and that is where 73% of defense efforts are focused, researchers say.

The New ‘Hook’: Free Streaming Services  
The newest type of attack relating to entertainment and media amid the pandemic is around streaming services, Benge says. ZeroFOX is observing a surge of scams on social media related to streaming services as more people are using them due to stay-at-home orders around the globe.

These scams target streaming service users and trick them into disclosing their account information in exchange for the false promise of a free streaming-service membership, Benge says. Many of these scams are circulated on social platforms to increase visibility and the likelihood of victims falling for the "offer." 

Benge points to a recent scam circulating across WhatsApp claims to offer free streaming-service membership to every user who enrolls in the program. The WhatsApp message appears to be from a particular streaming service and preys off users' vulnerability during the pandemic by offering free access as an act of goodwill. The message contains a link that directs visitors to a site intended to appear similar to a legitimate streaming site. The page displays a message that reads, "Due to the COVID-19 pandemic, we are giving away totally free access to our platform for the period of isolation, until the virus is contained."

Cyberattack Chatter Offers a Window into Planning
ZeroFOX researchers observed that attackers frequently use surface, Deep, and Dark Web chatrooms and forums to plan attacks, choose targets, and sell hacking services.

"Cybercriminals flock to both the surface and Dark Web, messaging groups, and even social media to market their portfolios of tools, including attack infrastructure and malware, and to dump data, sell stolen information, and network with other criminals," according to the study's authors.

Researchers recommend security managers in entertainment find ways to monitor the so-called chatter for useful intelligence to thwart attacks on talent, fans, and brand before they occur.

"Content monitoring can be highly valuable to media and entertainment organizations," the report states. "When personal information is leaked or physical threats are posted, early warning and immediate action is necessary to protect that individual and their online community. By monitoring content related to talent and immediately addressing threatening or offensive content, organizations mitigate this risk, especially when explicit and threatening content is detected."

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online. View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-24
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with &lt...
PUBLISHED: 2021-06-24
The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory sustainabl...
PUBLISHED: 2021-06-23
Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok. Successful attacks of this vulnerability can result in takeover of OpenGrok. CVSS 3.1 ...
PUBLISHED: 2021-06-23
A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.
PUBLISHED: 2021-06-23
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.