A highly personalized phishing campaign is currently exploiting excitement surrounding the FIFA World Cup 2026 to distribute a stealthy malware family known as Voidrift. Threat actors are utilizing extensive reconnaissance to customize emails with the recipient’s name, employer name, and even corporate logos embedded into images of free t-shirts, creating highly convincing lures. The campaign claims to offer exclusive World Cup apparel through a fabricated partnership, and has successfully bypassed widely deployed secure email gateways (SEGs) including Cisco IronPort, Microsoft ATP, and Abnormal Security. Once delivered, the Voidrift binary operates with a minimal detection footprint and actively resists analysis, making detection and response extremely difficult for security teams. To safeguard your organization, we urge employees to remain highly vigilant when receiving unsolicited promotional offers, even if they feature realistic corporate branding. As always, stay alert—if you receive any suspicious emails or partnership offers, forward the suspicious link or email to the emailSONAR AI-powered verification platform to safely verify its authenticity before proceeding.