Watching Today's Match on a Work Laptop: One Free Streaming Site Can Hand Your Company Passwords to Attackers

Live match streams were among the top Google searches in Saudi Arabia today, with Premier League and Serie A fixtures on. The risk to your company is not the match; it is the free site an employee opens on a work laptop to watch it. In December 2024 Microsoft traced a campaign that started on illegal streaming sites, hit nearly one million devices worldwide, and stole saved browser passwords plus files from Documents and OneDrive folders. The fix is cheap: a clear policy, blocking these sites on the company network, and phishing-resistant two-factor sign-in on the accounts that matter.

What happens when someone opens a free streaming site?

Unlicensed streaming sites live on advertising, and much of that advertising comes from networks that do not check what they serve. Microsoft described the chain it observed: the site carries malvertising redirectors that bounce the visitor through several intermediate sites until they land on an innocent-looking file hosted on GitHub. Once run, it installs an information stealer such as Lumma and a remote access tool called NetSupport.

• First target: passwords and cookies saved in Chrome, Edge and Firefox.
• Second target: files from the OneDrive, Documents and Downloads folders.
• Third target: details of the machine itself, to judge its value for resale or further abuse.

On a personal device that is a loss for its owner. On a work device signed in to email, the accounting system and online banking, it is an open door to the whole company.

How big is the risk, really?

A study by researcher Paul Watters, commissioned by the anti-piracy coalition ACE and published on July 23, 2025, examined piracy sites in 5 Southeast Asian countries. It found users of these sites are up to 65 times more likely to be infected with malware than on legitimate sites, and that their cyber threat risk is more than 22 times higher. The study was funded by an interested party, so we read the figure as a direction rather than a precise measurement, but the Microsoft incident confirms the same direction from an independent source.

In Saudi Arabia this is not only a technical matter: the Saudi Authority for Intellectual Property blocked more than 7,900 websites and removed more than 22,900 infringing items during 2024, according to the Saudi Press Agency. Some of these sites are already blocked, yet many reappear on new domains every week, which is exactly why manual block lists are not enough.

Why is a stolen password worse than the virus itself?

Wiping or encrypting malware reveals itself quickly. An information stealer works quietly: it takes what it wants and leaves, and the damage may surface weeks later, when someone logs in to your accountant's mailbox and sends an invoice with a different bank account. Stolen cookies mean an attacker may reuse a session that is already open without needing the password at all, which is why Microsoft recommends phishing-resistant two-factor methods such as FIDO keys rather than text messages alone.

Five steps for your company before next weekend's matches

1. Write the policy in one sentence: work devices are not used for unlicensed streaming sites; official streaming through licensed apps is allowed on the guest network.
2. Block at network level: use a DNS service that filters piracy and malware categories, since it updates itself as new domains appear.
3. Turn on browser web protection: Microsoft recommends enabling SmartScreen in Edge and Network Protection in Defender, and blocking executables and obfuscated scripts coming from downloads.
4. Stop saving work passwords in the browser: use a business password manager, because the browser is the first thing a stealer empties.
5. Enable phishing-resistant two-factor sign-in: start with email, online banking and accounting, the accounts attackers look for first.

The Origami view

We do not see this as a discipline problem. The employee who opens the match on a work laptop means no harm and usually does not know that the free site pays its way with poisoned ads. So the first fix is awareness and a legitimate alternative, not punishment.

In small and mid-sized businesses we also see the work laptop going home with the employee and joining a home network with no protection at all. Office network filtering is therefore not enough: protection has to live on the device itself, and on the accounts before the devices.

Conclusion

This season's matches come every week, and so do the free streaming sites. One hour of work this week is enough to write a one-line policy, switch on DNS filtering and browser protection, and enable two-factor sign-in on the financial accounts. If you suspect a device is infected, change its accounts' passwords from another device and end all open sessions before anything else. For the other side of the story, how streaming platforms protect their content, read Anti-Piracy and DRM for Live Sports Streaming, and if you need help hardening your company's devices, contact us.

Sources

• Microsoft Threat Intelligence: malvertising campaign from illegal streaming sites hit nearly one million devices
• Saudi Press Agency: SAIP blocks 30,000 websites and content items for IP violations
• ACE: consumers up to 65 times more likely to be infected with malware on piracy sites