Fake IPL Ticket and Streaming Scams Surge as Cybercriminals Target Cricket Fans, CloudSEK Warns

As the excitement around the 2026 Indian Premier League reaches a fever pitch, cybersecurity researchers at CloudSEK have uncovered a massive online fraud network exploiting cricket fans through fake IPL ticketing and streaming websites.

According to CloudSEK’s latest investigation, more than 1,000 malicious domains linked to IPL-related scams are actively targeting users this season. The report identified over 600 fake ticket-selling websites and more than 400 fraudulent “free streaming” platforms designed to steal money, personal data, and even cryptocurrency assets.

Fake IPL Ticket Websites Fool Thousands

Researchers say cybercriminals are taking advantage of fans desperate to secure last-minute IPL tickets. Many scam websites imitate trusted platforms by using similar branding, layouts, logos, and payment systems.

These fake portals often advertise “limited seats,” countdown timers, and heavily promoted match-day offers across social media, Telegram groups, search engines, and paid ads.

CloudSEK Expose – Fake IPL Ticket Websites

Victims are guided through what appears to be a legitimate booking process. After selecting seats and completing payment through UPI, QR codes, or online gateways, users receive professional-looking PDF tickets complete with booking IDs and QR codes.

The problem becomes clear only when fans arrive at the stadium and discover the tickets are invalid.

CloudSEK researchers revealed that these operations are far more advanced than traditional phishing scams. One exposed admin panel showed fraudsters managing ticket inventory, verifying payments manually, generating fake tickets instantly, and even tracking customer behavior through Meta Pixel integrations.

“The fake ticketing backend shows how industrialised these scams have become,” said Sourajeet Majumder, Security Researcher at CloudSEK. “Operators are optimizing fraud campaigns like legitimate e-commerce businesses.”

Free IPL Streaming Sites Spreading Malware

The report also highlighted a growing threat from fake IPL live-streaming websites promising free access to matches.

Many of these websites appear functional at first glance, displaying match schedules, team logos, and streaming buttons. However, once users click links, they are redirected to suspicious pages filled with malware, pop-ups, credential theft tools, and malicious downloads.

CloudSEK discovered that several sites used advanced browser-detection scripts capable of targeting users based on their device type and operating system.

macOS users were reportedly redirected to fake security update pages or counterfeit installer prompts that instructed them to paste commands into Terminal. Executing these commands triggered malware downloads.

CloudSEK Expose – Fake IPL Ticket Websites

SHub Stealer Malware Raises Alarm

Researchers identified one malware strain known as “SHub Stealer,” a macOS-focused infostealer capable of harvesting highly sensitive information.

The malware reportedly steals browser passwords, cookies, Telegram sessions, Apple Keychain data, iCloud credentials, cryptocurrency wallet information, and files stored on desktops or document folders.

CloudSEK warned that the malware can even target crypto wallet applications such as Ledger Live, Exodus, Atomic Wallet, and Trezor Suite by attempting to capture wallet seed phrases.

“What appears to be a free match stream can become a full device compromise,” Majumder explained. “Victims may unknowingly lose passwords, files, and crypto assets while simply trying to watch cricket online.”

Why IPL Scams Are Growing

Experts say the IPL’s massive popularity creates ideal conditions for cybercrime. The combination of emotional urgency, sold-out matches, and high online traffic makes fans more vulnerable to impulsive clicks and risky transactions.

CloudSEK advises fans to purchase tickets only through official IPL and authorized ticketing platforms while avoiding streaming links shared through social media, Telegram groups, or unknown websites.