World Cup 2026 Phishing Campaigns Target Mobile Users and Google Workspace
Summary
Zimperium details three World Cup 2026 phishing operations using fake ticket, merchandise and FIFA jobs sites. One active job portal relays Google Workspace credentials and MFA to hijack sessions; Zimperium says its mobile defense blocks the links.
Key points
- Zimperium describes three operations—Ghost Stadium, RetailPhish and OffsideHire—using World Cup ticket demand, merchandise promotions and recruitment lures to target fans and workers.
- Ghost Stadium sites mimic FIFA ticket and sign-in flows; the report says they collect credentials and payment details and can enable account takeover.
- RetailPhish uses WhatsApp messages, fake brand promotions and forced link-sharing to spread offers, then solicits personal details and credit-card information.
- OffsideHire uses fraudulent FIFA career portals; the report says the active fifajobs[.]com site relays corporate Google Workspace credentials, intercepts MFA and captures authenticated sessions. Its API response indicated data was sent to a Telegram bot.
- The report links retail campaign domains through shared registrar privacy-proxy identifiers and describes rapid domain rotation and Cloudflare masking.
- Zimperium says mobile-first lures can evade corporate network visibility when opened outside VPNs, and claims its Mobile Threat Defense detects and blocks the documented threats on-device.
Article Details
- Attack Vectors
- Fake FIFA ticket sites use typosquatted domains to harvest credentials and payment information.
- RetailPhish uses multilingual brand-impersonation pages, distributed primarily through WhatsApp, to collect personal and payment data and encourage victims to forward the links.
- Fraudulent FIFA recruitment portals capture corporate Google Workspace credentials and relay authentication in real time, including MFA, to hijack authenticated sessions.
- Campaign links are also distributed through fraudulent email, SMS, advertisements, and search results.
- Defensive Notes
- The report says these links may be opened on personal or BYOD devices outside corporate VPNs and perimeter controls.
- The report says Zimperium Mobile Threat Defense detects and blocks the documented threats on-device before credentials or payment details are submitted.
- The report describes rapid domain rotation and CDN concealment, and says domain blocklists, URL reputation databases, and corporate firewalls may not see links delivered through encrypted messaging or cellular networks.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fifa-careerpath[.]com | Fraudulent FIFA recruitment portal; part of the campaign targeting job seekers. |
| DOMAIN | fifa-hiring[.]com | Fraudulent FIFA recruitment portal; part of the campaign targeting job seekers. |
| DOMAIN | fifa-hr[.]com | Fraudulent FIFA recruitment portal; part of the campaign targeting job seekers. |
| DOMAIN | fifa-tickets[.]vip | Fake FIFA ticket site used to steal credentials and payment data. |
| DOMAIN | fifajobs[.]com | Operational fraudulent recruitment portal hosting an AiTM platform targeting corporate Google Workspace accounts. |
| HOSTNAME | fifeq2026eqbackeq[.]onrender[.]com | Operational backend for the OffsideHire AiTM platform; its booking API reportedly confirms real-time exfiltration to a Telegram bot. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationPhishing sites imitate FIFA, Nike, Adidas, and Google login experiences to appear legitimate.T1041 · Exfiltration Over C2 ChannelThe article reports booking data being sent from the OffsideHire backend to a Telegram bot.T1056.003 · Web Portal CaptureFake ticket and recruitment web pages capture credentials and other information entered by victims.T1071.001 · Web ProtocolsThe phishing applications submit credentials and registration data to backend APIs using HTTP POST requests.T1078 · Valid AccountsStolen FIFA credentials are used for account takeover, and the OffsideHire operation targets corporate Google Workspace accounts.T1185 · Browser Session HijackingThe OffsideHire platform captures the fully authenticated Google session after the victim completes MFA.T1204.001 · Malicious LinkVictims begin the attack flow by clicking links to fraudulent FIFA, retail, or recruitment websites.T1557.001 · Name Resolution Poisoning and SMB RelayThe OffsideHire backend relays victim credentials to Google's real infrastructure and intercepts MFA in real time.T1566.002 · Spearphishing LinkFraudulent links to fake ticket, retail, and recruitment sites are distributed through email, WhatsApp, SMS, advertisements, and search results.T1583.001 · DomainsOperators register lookalike domains to host spoofed FIFA ticket, retail, and recruitment pages.
Vendors
CloudflareInfrastructure shows strong organization, including Cloudflare hiding, shared registrant patterns, rapid domain rotation, and real-time exfiltration to Telegram.GoogleThe report highlights three coordinated operations—Ghost Stadium, RetailPhish, and OffsideHire—that use typosquatting, brand impersonation, and AiTM tactics to target fans and enterprise Google Workspace accounts.PingIdentityThe login and registration pages clone PingIdentity’s DaVinci authentication framework, the identity provider FIFA uses for its real SSO.ZimperiumZimperium reports its Mobile Threat Defense can detect and block these threats on-device before credentials or payment details are submitted.
Products
DaVinciThe login and registration pages clone PingIdentity’s DaVinci authentication framework, the identity provider FIFA uses for its real SSO.Google WorkspaceThe report highlights three coordinated operations—Ghost Stadium, RetailPhish, and OffsideHire—that use typosquatting, brand impersonation, and AiTM tactics to target fans and enterprise Google Workspace accounts.Mobile Threat DefenseZimperium reports its Mobile Threat Defense can detect and block these threats on-device before credentials or payment details are submitted.
Countries
Colombiawhile the multi-language URL templating allows the same kit to target fans across Spain, Germany, Colombia, Portugal, France, England, Croatia, and Ecuador simultaneously.Croatiaallows the same kit to target fans across Spain, Germany, Colombia, Portugal, France, England, Croatia, and Ecuador simultaneously.Ecuadorthe same kit to target fans across Spain, Germany, Colombia, Portugal, France, England, Croatia, and Ecuador simultaneously.EnglandURL templating allows the same kit to target fans across Spain, Germany, Colombia, Portugal, France, England, Croatia, and Ecuador simultaneously.FranceURL templating allows the same kit to target fans across Spain, Germany, Colombia, Portugal, France, England, Croatia, and Ecuador simultaneously.Germanylegitimacy, while the multi-language URL templating allows the same kit to target fans across Spain, Germany, Colombia, Portugal, France, England, Croatia, and Ecuador simultaneously.Portugalthe multi-language URL templating allows the same kit to target fans across Spain, Germany, Colombia, Portugal, France, England, Croatia, and Ecuador simultaneously.Spainperceived legitimacy, while the multi-language URL templating allows the same kit to target fans across Spain, Germany, Colombia, Portugal, France, England, Croatia, and Ecuador simultaneously.
Industries
recruitment[T1583.001] Acquire Infrastructure: Domains – Attackers register lookalike domains to host spoofed ticket, retail, and recruitment pages (‘registering domains that closely resemble official URLs’).Retailthrough fraudulent emails, WhatsApp messages, SMS, ads, and search results that direct them to fake FIFA, retail, and job sites (‘The website can be distributed through fraudulent emails, WhatsApp messages, SMS,SportsThe second is an active, high-risk retail campaign which mimics sports giants like Nike and Adidas by hiding its origin infrastructure behind Cloudflare.