GHOST STADIUM Phishing Campaign Targets FIFA World Cup Fans

Key Takeaways

• A sophisticated and financially motivated phishing campaign, dubbed “GHOST STADIUM,” is actively targeting FIFA World Cup fans.
• The operation leverages over 300 fake domains, impersonating official FIFA platforms to steal credentials, sell fake tickets, and distribute malware.
• Multiple fraud schemes are running concurrently, making this a complex and pervasive threat.
• Financial losses from this campaign could amount to billions of dollars, with thousands of legitimate FIFA account credentials already compromised.

Widespread Fraud Targets FIFA World Cup 2026 Fans with “GHOST STADIUM” Phishing

As anticipation builds for the 2026 FIFA World Cup, cybercriminals are unleashing a highly organized and expansive fraud operation designed to exploit the global fervor. Security researchers have identified a massive phishing campaign, codenamed “GHOST STADIUM,” which has deployed more than 300 fraudulent domains to ensnare unsuspecting football enthusiasts.

This meticulously crafted scheme is not only sophisticated but also exceptionally well-resourced, capable of deceiving even vigilant internet users. With the immense financial stakes surrounding the World Cup, this campaign represents one of the most significant cyber threats ever linked to a major sporting event.

Exploiting Unprecedented Demand for Tickets

The core of the “GHOST STADIUM” campaign capitalizes on the overwhelming demand for tickets to the FIFA World Cup 2026, which will be hosted across the United States, Canada, and Mexico. The initial two weeks of the ticket sales window saw over 150 million requests, creating a fertile ground for scammers to exploit the urgency and desperation of fans.

Fraudsters have established an extensive network of bogus websites, meticulously designed to mimic official FIFA platforms. Victims navigating to these sites often find it nearly impossible to distinguish them from legitimate sources, making them highly effective traps.

According to a report by Group-IB, shared with Cyber Security News (CSN), researchers have uncovered six distinct fraud methodologies, identified four independent threat actors, and pinpointed over 3,500 deceptive domains impersonating FIFA’s online presence.

The GHOST STADIUM Threat Actor

At the heart of this sprawling operation is a Chinese-speaking, financially driven threat actor known as GHOST STADIUM. This entity is orchestrating a coordinated phishing campaign across more than 300 domains, with potential financial losses from this single campaign estimated to reach into the billions.

The operation encompasses a diverse array of six parallel fraud schemes, each employing a different tactic to target football fans. These include:

• Credential phishing to steal login information.
• Fraudulent ticket sales.
• Online storefronts selling counterfeit merchandise.
• Deceptive streaming platforms.
• Bogus betting websites.
• Credential theft driven by infostealer malware.

Each of these schemes utilizes its own monetization strategy, complicating efforts to dismantle the entire operation through a singular takedown. Collectively, they form a rapidly expanding fraud ecosystem that is intensifying as the tournament draws nearer.

Already, over 2,513 confirmed FIFA account credential pairs are being traded on dark web markets, with prices ranging from $5 to $50 per pair. These credentials were not primarily acquired through targeted phishing but rather as incidental captures by broad infostealer campaigns, predominantly involving the Vidar and Lumma malware families.

Approximately 170,000 infostealer logs containing FIFA-related references have been identified, underscoring the vast scale of credential theft well in advance of the World Cup’s commencement.

GHOST STADIUM Phishing Campaign Mechanics

The GHOST STADIUM phishing kit is a custom-built, React-based single-page application that achieves an almost pixel-perfect replication of the official FIFA website. It is constructed using the Layui 2.7.6 framework, a Chinese UI library largely unknown outside of the Chinese developer community.

The kit faithfully mimics FIFA’s PingIdentity Single Sign-On (SSO) login process, leveraging a genuine client_id directly extracted from the actual FIFA SSO. Upon successful credential theft, the kit immediately initiates a password reset function to lock victims out of their accounts. Following this, it silently redirects them to the legitimate FIFA website, making the attack appear as a successful login attempt.

The phishing kit features automatic browser language detection, adapting its interface across 11 languages, including three distinct Chinese variants: Simplified, Traditional, and Hong Kong Chinese. This granular linguistic distinction serves as a direct indicator, pointing to a Chinese-speaking developer behind the operation.

Further evidence of a single operator controlling the entire campaign comes from the discovery of three shared Meta Pixel IDs across all 300 phishing domains, suggesting the use of Facebook advertisements to drive targeted traffic to these fraudulent pages.

Infostealer Threat and Protective Steps

Beyond the direct phishing efforts, an equally grave threat emerges from the infostealer pipeline. Malware such as Vidar and Lumma is distributed through lures like cracked software, malicious advertising networks, and illicit Telegram channels. These stealers are designed to extract all browser-stored credentials, session tokens, and cryptocurrency wallet seeds from infected devices. FIFA credentials are often collected as collateral damage, subsequently fueling account takeover attempts and resale on dark web markets.

What You Should Do

• For Organizations: Deploy Digital Risk Protection solutions for continuous monitoring and automated takedown of brand-impersonating infrastructure.
• For Fans:
  • Only purchase tickets and merchandise through official FIFA channels.
  • Enable multi-factor authentication (MFA) on all your online accounts, especially those related to FIFA or ticketing platforms.
  • Be extremely cautious of FIFA-themed advertisements or messages, particularly those offering unusually low prices or employing countdown pressure tactics.
  • Verify the URL of any FIFA-related website you visit. Look for “https://” and valid security certificates.
  • Avoid clicking on suspicious links in emails, SMS messages, or social media posts related to the World Cup.
• For Financial Institutions: Implement alerts for transactions routed through the five identified payment channels associated with this campaign.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.