Executive summary
Like consumers worldwide, European users of audiovisual piracy sites, apps, Illegal Streaming Devices, and Set-Top Boxes (STBs), often perceive that they can get “something for nothing” by using these services. Piracy is often perceived to be a victimless crime. The evidence presented in this study shows that the victim is the consumer, through the targeted delivery and installation of malicious software (malware) onto consumer devices, while they use audiovisual piracy sites, apps, ISDs and STBs. The impact of these malware infections can result in identity theft and fraud for the consumer, but also, lateral movement and further infection on any corporate network that they are connected to, such as remote working at home through a Virtual Private Network (VPN). Consumer behaviour is a direct threat to corporate networks, and the commercial consequences could be devastating, especially as more workers choose a flexible work pattern.
This study examined malware infection techniques across a broad range of actors targeting European consumers, finding that malware can be downloaded through malicious advertising, malicious popups, fake browser extension installations, browser notification hijacking, blocking notifications, adware, malicious software installation and banner ads. Furthermore, the study found an average 57% chance of an audiovisual piracy app being installed with embedded malware.
While European policymakers have focused on strengthening cybersecurity protections for many years, in practical terms – compared to Asian consumers in a similar study – there was no appreciable impact of these protections when visiting audiovisual piracy sites in relation to malware risk. The results of this study suggest that European regulatory frameworks need to focus on preventing consumer access to malicious audiovisual piracy sites, apps and STBs, through an expansion of regulatory site blocking, while acknowledging the risk of piracy-driven malware driving identity theft, in relation to the rollout of the European Digital Identity, and similar policy initiatives.
The full report can be downloaded from
here