FIFA World Cup 2026 Crypto Streaming Scam Network
Summary
A coordinated network of fraudulent websites, malicious streaming applications, phishing campaigns, and deceptive cryptocurrency schemes targeting FIFA World Cup 2026 fans across at least six fraud typologies. The campaign encompasses more than 4,300 registered fraudulent domains, Android banking trojans embedded in fake streaming apps, a Chinese-speaking threat actor designated GHOST STADIUM operating 300+ pixel-perfect FIFA clones, and at least one fan-branded token (WCUP) alleged to be a pump-and-dump scheme. The FBI issued a public service announcement on May 27, 2026; estimated losses from ticket fraud alone range from $71 million to $474 million, with total campaign potential described by Group-IB as reaching into the billions.
Connected Entities
1 entities · 10 linked investigations- + 5 more
Timeline(16 events)
2019-01-01
Domain fifa[.]city, later incorporated into the GHOST STADIUM campaign, is registered and begins operating, according to Group-IB.
Group-IB Blog2025-08-01
Group-IB records the start of systematic fraudulent domain registrations impersonating FIFA ahead of the 2026 World Cup, with 4,300+ such domains eventually catalogued.
Group-IB Blog2025-11-01
Group-IB first observes the GHOST STADIUM threat actor operating phishing infrastructure targeting FIFA World Cup fans.
Group-IB Blog2026-01-01
FortiGuard Labs begins counting World Cup-themed domain registrations; by May 2026, more than 13,000 such domains are recorded, approximately 8.8% assessed as malicious or suspicious.
FIFA World Cup 2026 Scams Surge As Fake Sites Target Fans — Cyble2026-02-01
First derivatives of the Massiv Android banking trojan are spotted embedded in pirated World Cup streaming applications, according to Malwarebytes.
FIFA World Cup 2026 Scams Are Already Live — The Hacker News2026-03-01
GHOST STADIUM domain registrations surge: 78 new domains registered in March 2026 alone, according to CybelAngel.
FIFA World Cup Fraud: 468 IOCs and Four Active Threat Vectors — CybelAngel2026-04-01
A Polygon wallet linked to a fake FIFA ticket phishing site receives approximately $1,562 in a single day, the largest single-day inflow TRM Labs documented across four tracked fraud wallets.
Tracking Crypto Scammers Ahead of the 2026 World Cup — TRM Labs2026-04-27
A coordinated batch of GHOST STADIUM redirector domains is registered in a single day, including football-ticket[.]top, football-ticket[.]shop, football-game[.]shop, and football-tickets[.]top.
GHOST STADIUM Score: Billions At Stake — Group-IB2026-04-29
A second coordinated domain registration event registers 30 additional GHOST STADIUM domains in a single day, according to CybelAngel.
FIFA World Cup Fraud: 468 IOCs and Four Active Threat Vectors — CybelAngel2026-05-27
FBI/IC3 issues Public Service Announcement I-052726-PSA warning of spoofed FIFA websites, documenting over 40 fraudulent domains and advising consumers to report incidents to ic3.gov.
IC3 PSA I-052726-PSA — FBI2026-05-27
Group-IB publishes the GHOST STADIUM research report, attributing the campaign to a Chinese-speaking threat actor and estimating potential losses of $71 million to $474 million for the premium ticket fraud tier alone.
GHOST STADIUM Score: Billions At Stake — Group-IB2026-06-09
CybelAngel confirms 344 clone domains actively mimicking the official FIFA website, with 125 live and serving content; 146 use Cloudflare nameservers to resist IP-level blocking.
FIFA World Cup Fraud: 468 IOCs and Four Active Threat Vectors — CybelAngel2026-06-10
WCUP token launches on LBank; Bubblemaps alleges 95% of supply was sniped at launch by more than 30 coordinated wallets funded from an exchange 30 minutes prior; market cap reaches approximately $50 million against only $536,000 in liquidity.
95% Of World Cup Token WCUP Supply Pre-Purchased By Single Group, Bubblemaps Alleges — BitcoinWorld2026-06-11
FIFA World Cup 2026 tournament begins, marking the opening of the highest-risk window for scam activity. Researchers designate June 11 through July 19, 2026 as the peak fraud period.
FIFA World Cup 2026 Scams Are Already Live — The Hacker News2026-06-15
CybelAngel publishes full threat report cataloguing 468 indicators of compromise across four active fraud vectors.
FIFA World Cup Fraud: 468 IOCs and Four Active Threat Vectors — CybelAngel2026-06-23
Malwarebytes, Help Net Security, and Tech-ish publish reports on fake streaming site networks, with Malwarebytes documenting more than 40 functionally identical scam streaming websites active during the tournament.
Free, no-signup World Cup streams serve scams instead of football — Help Net SecurityDecision Log
- hash: 6tA3rJxdsWSFG5JzeHB1vGcDXCTqY5uhcJJNMsERyTTr
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/23/2026, 11:36:35 PM
last updated: 6/23/2026, 11:36:49 PM
avoid.net — verified advice for a post-truth world