FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins
Summary: Researchers and the FBI are warning of FIFA World Cup 2026 fraud days before the June 11 kickoff, including thousands of lookalike FIFA domains, banking malware in pirate streaming apps, and a phishing operation that copies FIFA's PingIdentity single sign-on login closely enough to take over real accounts. Group-IB tracked more than 4,300 fraudulent FIFA domains registered since August 2025, with a Chinese-speaking group it calls GHOST STADIUM running one phishing kit across more than 300 of them, and it estimates losses from premium and hospitality ticket fraud alone at $71 million to $474 million.
Bottom line: Group-IB counted roughly 3,800 fraudulent FIFA domains already parked and unused, and with ready-made phishing kits and ticket-buying bots for sale, the campaign is positioned to scale into the June 11 to July 19 peak rather than wind down.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026