Olympic Gold for Scammers: Fake Shops Target Winter Games Fans in Global Cyber Heist

It started with a cuddly stoat named Tina and a worldwide Olympic craze - now it’s fueling one of the most sophisticated international scam operations of the year. As the buzz for the Milano-Cortina 2026 Winter Olympics reaches fever pitch, cybercriminals are rushing to cash in by creating convincing fake online stores, leaving fans heartbroken and out of pocket.

Fraud on Ice: How the Olympic Craze Became a Cybercrime Playground

The official Olympic mascots, Tina and Milo, have become global celebrities - especially the 27 cm plush toy that sold out within days on the official store. But as legitimate demand soared, scammers saw an opening. Nearly two dozen fraudulent websites have surfaced, each meticulously copying the look and feel of the real shop.olympics.com site. Even seasoned shoppers are struggling to spot the difference.

These fake shops - operating under domains like “2026winterdeals[.]top” or “olympics-sale[.]shop” - deploy subtle tricks, such as replacing the “o” with a zero, to fool visitors. They lure fans in with steep discounts, advertising the coveted Tina plush for as little as €20 - half the official price and well below market value. The scam is classic: too-good-to-be-true deals serve as bait. Once a user tries to buy, their payment card details, names, and addresses are harvested in seconds.

But the crime doesn’t end there. Victims may receive follow-up phishing emails or malware disguised as “order confirmations.” Instead of Olympic memorabilia, they get their money and identities stolen - and the plush never arrives.

Olympic-related scams aren’t new. From fake ticketing for Beijing 2008 to phishing attacks before Paris 2024, every major event has been shadowed by cybercrime. What’s changed this year is the scale and sophistication: AI-powered tools now let scammers automate the creation of cloned sites, complete with flawless translations and professional graphics, making them harder to distinguish from the real thing.

Data from cybersecurity firm Malwarebytes reveals the global reach of this campaign, with victims already identified on multiple continents. The company is actively blocking these malicious domains, but the sheer number and rapid deployment of new sites mean the threat is far from over.

Staying One Step Ahead

For fans eager to celebrate the Olympic spirit, vigilance is key. Always buy directly from the official site by typing the URL yourself. Treat dramatic discounts and surprise “back in stock” offers with suspicion, and scrutinize domain names for odd endings or swapped letters. Most important: never enter payment details on unfamiliar websites. Tools like Malwarebytes Browser Guard can provide an extra layer of defense, but awareness is your best shield.

With over three billion viewers expected to tune in to the Milano-Cortina Games, cybercriminals will continue to chase Olympic gold - at fans’ expense. Don’t let your Olympic dreams turn into a cyber nightmare.

WIKICROOK

• Phishing: Phishing is a cybercrime where attackers send fake messages to trick users into revealing sensitive data or clicking malicious links.
• Domain Spoofing: Domain spoofing is when attackers create fake websites or emails that closely resemble real ones to deceive users and steal sensitive information.
• AI: AI, or Artificial Intelligence, is technology that enables machines to mimic human intelligence, learning from data and improving over time.
• Telemetry Data: Telemetry data is information automatically collected from devices or software to monitor performance, detect issues, and maintain system health.
• Malware: Il malware è un software dannoso progettato per infiltrarsi, danneggiare o rubare dati da dispositivi informatici senza il consenso dell’utente.