FBI Warns of Fake FIFA Sites Targeting 2026 World Cup Fans
Summary
The FBI warns that fake FIFA sites are targeting 2026 World Cup fans to steal data and sell bogus tickets. Researchers also reported malvertising and more than 300 phishing sites tied to a Group-IB-attributed Ghost Stadium operation.
Key points
- The FBI says fake sites impersonate FIFA with lookalike domains, fake job portals and other event-related lures.
- Fraudulent sites may collect names, contact details and payment information for identity theft and financial scams.
- Group-IB and Bitdefender reported World Cup-themed malvertising across Google Search, Facebook, Telegram and WhatsApp.
- Group-IB researchers attributed an operation using more than 300 cloned FIFA phishing sites for premium ticket fraud to the Chinese threat actor Ghost Stadium.
- Bitdefender observed fraudulent offers involving merchandise, streaming services and Panini stickers in multiple countries.
- The FBI advises fans to type fifa[.]com directly, avoid suspicious links and sponsored search ads, and verify sites before entering sensitive information.
Article Details
- Event Type
- FBI warning about fraudulent FIFA-impersonation websites, alongside reported World Cup-themed phishing and malvertising campaigns.
- Impact
- The sites and campaigns aim to steal personal and payment information, commit identity theft and financial fraud, and sell fake tickets, hospitality packages, merchandise, and other offers. Group-IB attributed an operation using more than 300 cloned FIFA phishing sites for premium ticket fraud to Ghost Stadium.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fifa-hiring[.]com | Fake employment-portal domain identified as an example of a fraudulent FIFA-impersonation site. |
| DOMAIN | fiffa[.]com | Lookalike domain identified as an example of a fake FIFA site used to deceive users. |
| DOMAIN | jobs-fifa[.]com | Fake employment-portal domain identified as an example of a fraudulent FIFA-impersonation site. |
Threat Actors
Countries
Algeriaobserved fraudulent activity around the World Cup brand targeting users in the UK, Portugal, Spain, Algeria, the US, Canada, Mexico, Brazil, Germany, and Australia, with fake merchandise, kits and collectibles,Australiabrand targeting users in the UK, Portugal, Spain, Algeria, the US, Canada, Mexico, Brazil, Germany, and Australia, with fake merchandise, kits and collectibles, streaming services, and Panini sticker offers.Brazilaround the World Cup brand targeting users in the UK, Portugal, Spain, Algeria, the US, Canada, Mexico, Brazil, Germany, and Australia, with fake merchandise, kits and collectibles, streaming services, and PaniniCanadaWith the international soccer tournament set between June 11 and July 19 in the United States, Canada, and Mexico, threat actors prepared hundreds of phishing sites.Germanythe World Cup brand targeting users in the UK, Portugal, Spain, Algeria, the US, Canada, Mexico, Brazil, Germany, and Australia, with fake merchandise, kits and collectibles, streaming services, and Panini stickerMexicoWith the international soccer tournament set between June 11 and July 19 in the United States, Canada, and Mexico, threat actors prepared hundreds of phishing sites.PortugalFebruary, Bitdefender observed fraudulent activity around the World Cup brand targeting users in the UK, Portugal, Spain, Algeria, the US, Canada, Mexico, Brazil, Germany, and Australia, with fake merchandise, kits andSpainBitdefender observed fraudulent activity around the World Cup brand targeting users in the UK, Portugal, Spain, Algeria, the US, Canada, Mexico, Brazil, Germany, and Australia, with fake merchandise, kits andUnited StatesWith the international soccer tournament set between June 11 and July 19 in the United States, Canada, and Mexico, threat actors prepared hundreds of phishing sites.