World Cup: Inside the 2026 FIFA Cybercrime Surge

Six million fans, 150 million ticket requests, and an event roughly thirty times oversubscribed. For criminals who trade on urgency, scarcity, and the emotional pull of a once-in-a-lifetime purchase, the 2026 FIFA World Cup is close to a perfect storm. They have already built the infrastructure to exploit it.

The 2026 FIFA World Cup is on track to be the largest sporting event ever staged. Running from June 11 to July 19 across the United States, Canada, and Mexico, the tournament will host 104 matches in 16 cities, draw an estimated six million fans into stadiums, and reach billions more online. More than 150 million tickets were requested in just the first two weeks of sales, which by Group-IB’s reckoning leaves the event roughly thirty times oversubscribed compared with previous tournaments. For criminals who make their living on urgency, scarcity, and the emotional pull of a once-in-a-lifetime purchase, those conditions are close to perfect.

That opportunity has not gone unnoticed. Threat intelligence firms, the FBI, and mobile-security researchers have all documented a steep climb in phishing infrastructure, counterfeit websites, malware campaigns, fraudulent mobile apps, and account-takeover activity tied to the tournament. The buildup began months before kickoff and is widely expected to peak during the tournament window itself.

A Sprawling Ecosystem of FIFA-Themed Fraud

The most detailed picture comes from Group-IB, whose investigation ran from March to May 2026. Researchers tracked more than 4,300 fraudulent domains impersonating FIFA’s official web presence, registered since August 2025, along with six distinct fraud schemes operated by four independent threat actors. Most of those domains are not yet live: roughly 300 are actively running fraudulent infrastructure while approximately 3,800 sit parked and dormant, pre-positioned to switch on as the tournament nears.

At the center of the operation is a financially motivated actor Group-IB tracks as GHOST STADIUM, which it describes as Chinese-speaking and first observed in November 2025. The six parallel schemes span credential phishing, fake ticket sales, counterfeit merchandise storefronts, bogus streaming platforms, fraudulent betting sites, and infostealer-driven credential theft, each with its own way of making money, which makes the whole ecosystem far harder to dismantle than any single takedown would suggest.

What distinguishes GHOST STADIUM is craftsmanship rather than volume. Rather than crude knock-offs, the group built what Group-IB calls a meticulously engineered impersonation. The phishing kit is a pixel-perfect clone of the FIFA site, supports eleven languages, and replicates FIFA’s single sign-on authentication, targeting the Ping Identity SSO system to intercept login credentials.

The damage extends well past a single fake ticket: victims may surrender account credentials, payment card data, passport details, and other personal information that feeds later fraud. The estimated losses are large but reported in ranges, and worth treating with appropriate caution. Group-IB’s figures place premium-ticket fraud alone between $71 million and $474 million, with total campaign losses potentially reaching into the billions. One analysis framed the platform as a phishing-as-a-service operation that enabled theft of up to $10,000 per ticket from at least 47,000 victims.

The criminal interest is not limited to one firm’s telemetry. The FBI issued a public service announcement warning that threat actors are spoofing FIFA websites to steal personal and financial data, identifying at least 36 fraudulent domains and cautioning that more would appear as the June 11 opening approached. The fake sites lean on typosquatting, lookalike domains, and cloned branding, and target not only ticket and merchandise buyers but job seekers as well. Separately, FortiGuard Labs found that more than 13,000 FIFA World Cup 2026-themed domains were registered between January and May 2026, of which about 8.8% were assessed as malicious or suspicious.

Malware Is Following the Fans

Fraudulent websites draw the headlines, but malware may carry the heavier long-term risk. Big tournaments reliably generate enormous search volume, for tickets, schedules, travel, and streams, and every one of those searches is a chance for an attacker to slip malicious content in front of someone who is actively looking.

Modern operations increasingly skip the obvious malicious executable in favor of files that look entirely ordinary. Payloads are disguised as ticket confirmations, travel itineraries, hospitality packages, merchandise invoices, schedules, or promotional offers, then pushed through email, messaging apps, social ads, and compromised sites. The psychology is the point: a suspicious link makes people hesitate, but a file named something like World Cup Ticket Confirmation.pdf feels harmless. That trust is exactly why malicious documents remain one of the most effective initial-infection vectors in use today.

The techniques for weaponizing files have also broadened. Where earlier campaigns leaned heavily on Microsoft Office macros, attackers now abuse a much wider range of formats, including PDFs, OneNote files, compressed archives, HTML attachments, SVG images, JavaScript files, ISO images, and Windows shortcut files. A common chain starts with an emailed or downloaded archive containing a script disguised as a document; once run, it invokes PowerShell to pull further malware from attacker infrastructure. Comparable methods have appeared in campaigns distributing LummaC2, Vidar, Remcos, AsyncRAT, NetSupport RAT, PureLogs, and assorted banking trojans. Because PDFs are so widely trusted in business settings, weaponized PDF and SVG files, capable of carrying embedded scripts, malicious links, or social-engineering content that triggers secondary downloads, have become especially reliable delivery vehicles.

Streaming Apps That Hijack Your Phone

For fans hunting free match streams, the sharpest danger sits on mobile. ThreatFabric observed a spike in malicious unofficial streaming apps, many impersonating the popular RojaDirecta, around the recent Champions League final, and expects a larger repeat during the World Cup. Kaspersky linked those apps to Android banking trojans built to drain banking and cryptocurrency accounts, naming two families in particular: Massiv and Perseus.

These apps live outside official stores, so installing one means deliberately clicking past the very warnings designed to stop it. Once on the device, they request Android Accessibility Service permissions, which hands the operator sweeping control. From there the malware can overlay fake bank login screens on top of real apps, log keystrokes, intercept one-time passcodes from texts and authenticator apps, and operate the screen remotely.

Perseus is the more advanced of the two. ThreatFabric attributes it to the leaked source code of Cerberus, a prolific banking trojan whose code was exposed in 2020. Its standout behavior is data hunting beyond the banking app: Perseus actively scans note-taking apps such as Google Keep, Evernote, and Simple Notes, opening them to extract stored content, including passwords, financial details, and cryptocurrency recovery phrases. Notably, ThreatFabric assessed that the more advanced English-language build shows signs of large-language-model assistance in its development, inferred from extensive in-app logging and emojis left in the source code.

Stolen Credentials Keep Paying Out

Credential theft is a recurring endgame, and the harvested data rarely stays put. Infostealer families such as LummaC2, Vidar, RedLine, and Raccoon Stealer continue to scrape browser passwords, session cookies, payment card data, and crypto wallets from machines worldwide, after which the loot is typically resold on criminal marketplaces to fund account takeovers, financial fraud, and follow-on intrusions.

FIFA-related material is already circulating. Group-IB found over 2,500 valid FIFA credential pairs for sale on dark-web markets at $5 to $50 each, harvested incidentally by mass infostealer campaigns dominated by Vidar and Lumma rather than through targeted phishing, alongside roughly 170,000 infostealer logs referencing FIFA. Fortinet’s telemetry points the same direction: FortiGuard Labs detected more than 4,600 FIFA-associated URLs in stealer-log data tied to Vidar, LummaC2, and RedLine, plus more than 260 FIFA employee credentials and over 270,000 credentials from users and fans of FIFA-related sites.

Social Media as a Distribution Engine

Attackers have also moved well beyond spam email. Paid advertisements, fake influencer accounts, Telegram channels, and WhatsApp groups now funnel victims toward malicious downloads, typically by dangling discounted tickets, exclusive hospitality, betting deals, merchandise, or free streams. Behind the offer sits a malicious archive, a fake app, or a credential-harvesting page. The approach sidesteps much traditional email filtering while reaching huge audiences cheaply, and in GHOST STADIUM’s case, Facebook Ads served as the primary paid-traffic channel, with multiple Meta Pixel IDs embedded across the domain cluster to target victims.

Why File Security Matters More Than Ever

The World Cup landscape reflects a broader shift that reaches well beyond football. Fraudulent websites can often be blocked quickly and phishing domains taken offline, but a malicious file is stickier. It gets forwarded internally, uploaded to collaboration platforms, shared through messaging apps, synced to cloud storage, or archived in document repositories, continuing to pose a risk long after the original infrastructure has gone dark.

The reason this matters is that attackers increasingly bury malicious functionality inside everyday formats rather than shipping obvious executables. Office documents may carry macros, external templates, OLE objects, embedded scripts, or links to attacker infrastructure; PDFs can hide JavaScript or redirection logic; archives can conceal secondary payloads; and HTML and SVG attachments are being used to kick off multi-stage infection chains. Often the file is simply the opening move, a delivery platform for malware fetched later, which is what lets these attacks slip past perimeter defenses. The campaigns documented by Group-IB, Fortinet, Kaspersky, and ThreatFabric show how effectively criminals exploit trusted formats: a fake ticket confirmation or hospitality package can look completely legitimate while quietly doing the attacker’s work, and because users download and open these files voluntarily, conventional controls struggle to separate the malicious from the mundane.

This is where Data Validation, Disarm and Reconstruction (DVDR) technologies such as CyberQuay‘s FileDNA take a different tack. Instead of trying to decide whether a file is malicious through signatures, behavioral heuristics, or sandbox detonation, FileDNA performs deep static analysis of incoming files, identifies active and potentially dangerous elements, strips them out, and rebuilds a clean version of the document while preserving the legitimate business content. If a FIFA-themed document carries embedded macros, JavaScript, OLE objects, malicious hyperlinks, hidden scripts, or exploit code, the approach extracts the usable information while neutralizing the dangerous components before the file ever reaches a user, removing the attacker’s ability to use the file as a delivery vehicle at all.

That preventive posture is especially valuable during a global event, when fresh phishing campaigns routinely appear faster than threat-intelligence feeds can catalog them. By focusing on the file itself rather than on known indicators of compromise, DVDR reduces the risk from previously unseen malware and weaponized documents that detection systems have not yet classified. It is best understood not as a replacement but as an added layer alongside email security, endpoint detection and response, web filtering, and identity protection.

Looking Ahead

The 2026 World Cup has already drawn thousands of fraudulent domains, large-scale phishing, malware-laden streaming apps, credential-theft campaigns, and sophisticated social engineering aimed at fans worldwide. The most acute danger may not be the obviously fake website but the file a fan willingly downloads while chasing tickets, streams, or travel details. As attackers keep weaponizing common formats and trading on the trust people place in familiar documents, file-based delivery remains one of the most effective and scalable techniques available to them.