The alert comes at a time when Brazil is facing a record number of phishing attacks. A recent Kaspersky survey shows that the country has seen an 80% increase in the detection of this type of attack, with an average of 1.5 million phishing attempts — driven by large-scale automated scams powered by Artificial Intelligence. In this case, cybercriminals are taking advantage of the strong interest generated by COP30 to create highly convincing traps aimed at obtaining financial and personal information from victims, particularly because many authorities and public figures are interested in participating in the Conference.
"COP30 is the perfect event for digital attacks because it combines factors such as global relevance, strong public interest and a high volume of official communications — making it difficult for victims to differentiate what is legitimate from what is fraudulent. What we are seeing is the use of several social engineering tactics, from fake government websites to fake hotel booking pages, to carry out phishing schemes. It’s also important to highlight that AI is being used to make these fake pages increasingly similar to official ones, which means users need to be even more careful", explains Fabio Assolini, Director of Kaspersky’s Global Research & Analysis Team (GReAT) for Latin America.
Criminals are creating fake websites in Portuguese and English impersonating official government agencies to supposedly register people for the event. The goal is to trick journalists, authorities, business leaders and interested participants into entering their personal information. Once victims insert their data, it is captured by cybercriminals, who may later use it in other scams.
Cybercriminals also create pages that imitate hotel reservation portals. Taking advantage of participants’ interest in securing accommodation near the event location, these fake sites induce people to provide sensitive personal details—such as full name, taxpayer ID, address, email, phone number, and credit card information (number, expiration date and CVV)—which are collected and can result in financial losses for victims.
Criminals create false pages that simulate volunteer application forms for the event. These pages prompt candidates to provide sensitive personal information—such as full name, taxpayer ID, address, email, phone number, scanned documents and login credentials. These details may later be used in other fraud schemes or attacks.
To protect yourself from phishing scams, Kaspersky recommends:
Always verify the official source: all registrations, accreditations and event-related information should be confirmed directly on the official UN and COP30 websites. Be suspicious of links received via email, SMS or social media.
Inspect the sender address and website URL carefully. Traditional signs of phishing — such as typos or generic wording — are now corrected by AI, making fake pages more convincing. Official websites always begin with the institution’s name in the main domain. If the institution’s name is missing or slightly altered, treat it as a major warning sign. When in doubt, manually type the address into your browser or use the official app.
Be cautious with invitations and attachments: do not click on links or download attachments from unexpected emails, even if they appear to come from legitimate organizations. Treat calendar invitations from unknown senders with extreme caution.
Be wary of offers and discounts: scams may offer exclusive hotel deals, transportation discounts or special event access. If the offer seems too good to be true, it likely is.
Use a security solution: keep a trusted security solution, such as Kaspersky Premium, installed on all your devices. It can block malicious websites and links before they cause any harm.
