You googled about Pope, hackers got your password

While the world is mourning, cybercriminals are cashing in on the death of Pope Francis, turning grief into clicks, scams, and stolen data.

The internet didn’t even have time to catch its breath after Pope Francis' death before the scammers swarmed in. Like clockwork, cybercriminals are using the global shock and mourning to do what they do best: trick, steal, and profit.

This isn’t new. Whenever the world stops to grieve, whether it's Queen Elizabeth II’s passing, an earthquake in Turkey and Syria, or the chaos of COVID-19, hackers crank out their digital bait.

Emotional moments create a perfect storm: people are glued to their screens, desperate for information, and far less skeptical than usual. That’s when the trap gets set.

AI-generated images flood platforms like TikTok, Instagram, and Facebook, some claiming to show unseen footage or tributes to the late Pope. Some look real enough to fool even the moderately skeptical. People click. People search. And that’s exactly what the attackers want.

According to researchers at cybersecurity firm Check Point, phishing and malware campaigns spike every time a major event like this happens.

One recent scam redirected users from a fake “Pope Francis breaking news” site to a bogus Google page offering gift cards. It was a classic move: distract them with something emotional and then hit them with the digital version of “just send me your credit card info real quick.”

Another dangerous trick in the book is SEO poisoning. That’s when scammers buy their way into Google’s top search results, slipping malware-laced sites right into the middle of what looks like totally legit news articles. You Google “Pope Francis death update,” click on what looks like a normal link, and end up on a malicious website.

Researchers say that behind the scenes, scripts can silently fire off the moment you land on the page, no additional clicks needed. These background commands quietly scoop up details like your device name, operating system, location, and language settings.

This way, scammers can build a profile on the victim to launch more convincing phishing attacks later to steal precious credentials, or just sell information on the dark web.

A lot of these scammy domains don’t show up on security radars. They’ve either been registered recently or sat dormant for months, so tools that normally flag suspicious sites don’t catch them. It’s a game of digital camouflage, and the attackers are getting really good at it.

“Cybercriminals thrive on chaos and curiosity. Whenever a major news event occurs, we see a sharp rise in scams designed to exploit public interest,” write the researchers.

“The best defense is a combination of user awareness and layered security protection.”