Forcepoint Identifies World Cup 2026 Scams Targeting Crypto Wallets, Ticket Buyers and FIFA Lottery Seekers
Summary
Forcepoint X-Labs identified three World Cup 2026 scams: a Stake.com-impersonating wallet drainer, a SeatGeek typosquatted ticket site, and FIFA lottery emails seeking personal data and potentially enabling advance-fee fraud.
Key points
- A phishing email impersonating Stake.com directs recipients through a Vercel-hosted redirect to a fake DeFi page; connecting a wallet triggers a drainer that transfers assets.
- The reported drainer flow uses web-stake[.]com, ilvvtestetd[.]vercel[.]app and get[.]rpc-stake[.]com/farm.
- A fake SeatGeek ticket offer uses the typosquatted domain seatgaek[.]com to collect payment card details; the article says buyers receive no tickets.
- Two FIFA lottery emails claim multi-million-dollar or pound prizes and request extensive personal information; Forcepoint says the data could be sold or used for follow-on fraud, including advance-fee schemes.
- Forcepoint recommends verifying domains, avoiding wallet links in unsolicited email, and treating urgent offers and unsolicited prize claims with skepticism.
- Forcepoint says its email analytics and Real-Time Scanning block parts of these campaigns for its customers.
Article Details
- Event Type
- Forcepoint X-Labs identified three active World Cup 2026-themed phishing and fraud campaigns: a crypto wallet drainer impersonating Stake.com, ticket fraud impersonating SeatGeek, and advance-fee lottery scams impersonating FIFA.
- Impact
- The scams can steal cryptocurrency through wallet-drainer transactions that the article says cannot be reversed, collect payment-card details without delivering tickets, and harvest personal information for resale or follow-on fraud.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//get[.]rpc-stake[.]com/farm | Fraudulent DeFi landing page identified as the crypto wallet drainer destination. |
| URL | hxxps[:]//ilvvtestetd[.]vercel[.]app/ | Vercel-hosted redirect used in the phishing email to route recipients toward the crypto wallet drainer. |
| URL | hxxps[:]//seatgaek[.]com | Typosquatted phishing site impersonating SeatGeek and used to collect payment-card details for fraudulent ticket sales. |
People
Vendors
ForcepointForcepoint X-Labs has identified three active attack types exploiting World Cup 2026 excitement: a crypto wallet drainer impersonating a well-known gambling platform, a typosquatted ticket-selling site targeting fansVercelThe embedded link doesn't go directly to the drainer. Instead, it routes the recipient through a Vercel-hosted redirect at hxxps://ilvvtestetd[.]vercel[.]app/. The use of Vercel is deliberate. As a legitimate and widely