Free streaming platforms such as Fútbol Libre, used to watch competitions like the UEFA Champions League and the Copa Sudamericana, and the Xuper TV app for films are drawing large numbers of Spanish-speaking users. According to a report by Infobae citing Spain's National Cybersecurity Institute (INCIBE), these services redistribute pay-TV signals without authorisation and expose visitors to malware, banking credential theft, hidden crypto mining and fraudulent advertising.
How they operate. Fútbol Libre works as an aggregator of links and embeds for pirated sports streams, using proxy servers that constantly change domain to dodge court blocks and takedown orders. Xuper TV, described as the successor to Magis TV, runs on IPTV through apps not available in Google Play or the Apple App Store. Users must sideload APK installer files onto Android phones, smart TVs or TV boxes.
Clones everywhere. According to Infobae, authorities and broadcasters have blocked many of the original Fútbol Libre sites in recent months. As a result, almost all search results under that name now point to clones run by cybercriminals who take advantage of traffic spikes on match days.
From trojans to ransomware. The main risk is the forced download of extensions or APK files, often presented as a way to improve stream quality, which can actually contain trojans, spyware or banking malware able to steal credentials and empty accounts. INCIBE warns that a malicious app can steal information, lock the device or enable fraudulent transactions. Threats include keyloggers that record what is typed on screen, and ransomware that demands payment to restore files, with no guarantee they will be returned.
Your bank codes at risk. If an app has permission to read SMS, it can access the one-time codes that banks and digital wallets use to confirm operations, making it easier to drain accounts before the victim notices. Accepting notification permissions can also unleash misleading ads and phishing messages, while hidden scripts can start crypto mining with a click on a fake play button.
Why it matters
A threat to the whole home. When these apps are installed on a smart TV or TV box connected to the home router, an infected device can act as a bridge to intercept traffic from other devices on the same Wi-Fi network, according to the report. Common tricks also include fake free sign-up forms that capture bank details, ads disguised as video controls and fake VIP promotions in exchange for personal data.
- Be wary of streaming apps asking for access to SMS, contacts or precise location: a video player does not need them.
- Avoid installing APK files from unknown websites; official stores add an extra barrier, though not total protection.
- Check that a site uses https and belongs to a recognised organisation.
- If you installed one and notice ads, slowness or odd permissions, uninstall it, scan the device and change passwords used on it.
- Keep backups in the cloud or on external drives to limit ransomware damage.
Source: Infobae / INCIBE
Leave a Reply