FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure
Summary
A coordinated, multi-actor scam infrastructure emerged around the 2026 FIFA World Cup (hosted across Canada, Mexico, and the United States, June 11 to July 19, 2026), comprising more than 13,000 to 19,000 registered World Cup-themed domains of which approximately 8.8% have been flagged as malicious or suspicious. The infrastructure combines typosquatted FIFA domains, AI-generated fake ticketing portals, cryptocurrency wallet drainers, seed-phrase phishing kits, and Android banking trojans, with at least one threat actor cluster — designated GHOST STADIUM — attributed to Chinese-speaking operators. The FBI issued a formal public service announcement on May 27, 2026, warning consumers and reporting at least 36 confirmed fraudulent domains spoofing official FIFA web properties.
Connected Entities
1 entities · 10 linked investigations- + 2 more
Timeline(13 events)
2025-08-01
GHOST STADIUM begins registering fraudulent FIFA domains; Group-IB first observes the threat actor cluster
Group-IB Blog2025-11-17
First major GHOST STADIUM domain registration wave identified by Hunt.io infrastructure analysis
Hunt.io2026-01-01
FortiGuard Labs begins observing rapid accumulation of World Cup-themed domain registrations; count reaches 13,000+ by May
Fortinet FortiGuard Labs2026-03-20
Second major GHOST STADIUM domain registration wave, March 20-31; 78 domain registrations recorded in March overall
CybelAngel Threat Report2026-04-01
TRM Labs-tracked Polygon wallet address receives approximately $1,562 from fake ticketing scam victims
TRM Labs2026-04-27
Threat actor claiming ShinyHunters affiliation publishes alleged AFC and Al Nassr FC database containing 150,000+ passport records and player contracts on a cybercrime forum
TechRadar2026-04-29
Single-day peak: 30 fraudulent FIFA domain registrations observed in one day
CybelAngel Threat Report2026-05-27
FBI IC3 issues PSA I-052726-PSA formally warning consumers about FIFA website spoofing and identifying at least 36 fraudulent domains
FBI Internet Crime Complaint Center2026-06-08
Help Net Security reports Intel 471 assessment that 2026 FIFA World Cup represents 'the largest and most complex cyberattack surface in sporting history'; total domain count cited at 19,000+
Help Net Security2026-06-09
CybelAngel publishes threat report documenting 468 indicators of compromise across four fraud vectors, with 125 clone domains actively live
CybelAngel2026-06-09
Arctic Wolf Labs publishes research on adversary-in-the-middle (AiTM) phishing kit defeating all FIFA account MFA methods in real time
Arctic Wolf Labs2026-06-10
WCUP (World Cup PvP) memecoin launches; reaches approximately $50 million market cap on day one following alleged undisclosed paid promotions by crypto influencers on X
TRM Labs / AMBCrypto2026-06-11
2026 FIFA World Cup tournament begins; scam infrastructure already fully operational across all documented vectors
The Hacker NewsDecision Log
- #1publish⛓ pending8/9/2026, 12:35:38 PMhash: Ei79r9weWmbR52jpi6FebGDQSfu5RTHbPikVCZD1RbFk
18 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/9/2026, 12:35:23 PM
last updated: 8/9/2026, 4:28:59 PM
avoid.net — verified advice for a post-truth world