Cybercriminals Exploit 2026 FIFA World Cup With Phishing, Fake

The 2026 FIFA World Cup, a major global football event, has already become a significant target for cybercriminals. These threat actors are actively leveraging the anticipation surrounding the tournament as a lucrative business opportunity, as detailed in a recent report.

Threat actors have been building fake FIFA stores, spinning up phishing pages, and launching purchase scams at a scale that has security researchers watching closely.

The tournament, hosted across sixteen cities in the United States, Mexico, and Canada, draws billions of eyes worldwide. That global attention makes it one of the most attractive events for online fraud.

Criminals are exploiting that interest to steal payment card data, harvest personal information, and trick fans into paying for tickets or merchandise that will never arrive.

Analysts and researchers at Recorded Future said in a report shared with Cyber Security News (CSN) that cybercriminal exploitation of World Cup branding is already well underway.

Their Payment Fraud Intelligence team has tracked fake FIFA-branded stores, purchase scams, and spoofed FIFA and host-city domains, with fraudulent activity expected to intensify as the tournament progresses.

What makes this wave of fraud different from past World Cups is the role artificial intelligence now plays. Threat actors are using AI-generated content to produce phishing emails, smishing messages, and fake websites at a pace that no single security team can easily track.

The result is a fraud landscape that is faster, more convincing, and harder to contain than anything seen before the era of generative AI.

The threat does not stop at individual fans. Corporate sponsors, affiliated vendors, travel providers, and ticketing platforms are all in the crosshairs.

Stolen payment credentials are being used by carders to buy real tickets, which are then resold for profit. This kind of fraud lets criminals move money quickly while hiding behind the appearance of a normal transaction.

Cybercriminals Exploit 2026 FIFA World Cup

In one campaign active during April and May 2026, Recorded Future’s Payment Fraud Intelligence team identified a network of 33 World Cup-themed purchase scam domains connected to roughly 2,500 online advertisements.

These fake stores were built to look like official FIFA merchandise outlets, attracting victims through ads on platforms like Meta. When a victim made a purchase, the order never arrived, but their payment card data and personal information were fully exposed.

Several of those scam domains used multiple merchant accounts to keep payments flowing even as individual domains were rotated out.

This allows criminals to keep their payment infrastructure running behind the scenes, even when one storefront gets taken down. It is a level of sophistication that makes these scams harder to stop than a simple one-off fake website.

In a second campaign, threat actors compromised legitimate websites and manipulated how those pages appeared in search results. Victims searching for official FIFA merchandise would land on what looked like a trusted site, only to be quietly redirected to a scam domain.

The scam pages did not even need to appear in search results, because the traffic came through already-indexed pages.

Phishing, Dark Web Activity, and Stolen Credentials

Since April 1, 2026, Insikt Group researchers detected more than 1,100 suspicious domains containing the words “World” and “Cup,” over 600 typosquat domains mimicking fifa.com, and 260 registered domains combining FIFA branding with host-city names.

Chinese-speaking threat actors have reportedly cloned FIFA’s official website across around 300 domains to harvest user credentials ahead of the tournament.

On the dark web, stolen FIFA-related credentials linked to individual accounts are already being sold on marketplaces like Russian Market.

Threat actors have also been spotted advertising cash-out services on criminal forums, targeting major ticketing platforms including Ticketmaster, StubHub, and SeatGeek. These services let criminals convert stolen payment data or account access into real money fast.

Security experts recommend that fans avoid clicking links in unsolicited emails or texts about World Cup tickets and always verify any store or ticket source through official FIFA channels.

Organizations connected to the tournament should monitor for brand abuse, newly registered lookalike domains, and compromised credentials appearing on dark web forums. Proactive credential monitoring and domain alerting are among the strongest defenses available right now.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.