{"investigation":{"slug":"fifa-world-cup-2026-crypto-streaming-scam-network","entity_name":"FIFA World Cup 2026 Crypto Streaming Scam Network","trust_score":0,"severity_base":null,"score_modifier":-3.36,"confidence":0.88,"status":"under_investigation","content_type":"investigation","summary":"Ahead of and during the 2026 FIFA World Cup, multiple independent cybersecurity firms and law enforcement agencies identified a large, loosely-connected ecosystem of scams using the tournament's branding: thousands of fake FIFA domains, fake ticketing and streaming sites bundled with Android banking malware, wallet-draining phishing kits, and World Cup-themed memecoins alleged to involve insider concentration. No single organization or individual has been confirmed as running all of this activity; researchers (Group-IB, TRM Labs, Malwarebytes, Kaspersky, ThreatFabric, Forcepoint, Bubblemaps) describe it as several distinct threat actors and schemes sharing a common theme rather than one unified network. Reported crypto losses confirmed on-chain so far are modest (TRM Labs identified under $1,700 across the addresses it tracked as of June 2026), while researchers' loss estimates for the broader fraud ecosystem range into the hundreds of millions to billions of dollars.","sections":[{"content":"Security firm Group-IB reported that it identified more than 4,300 fraudulent domains impersonating FIFA or World Cup ticketing registered since August 2025, with roughly 300 active and about 3,800 parked or dormant pending activation closer to the tournament. Group-IB attributed this activity to four independent threat actors running at least six distinct fraud schemes, one of which it designated \"GHOST STADIUM.\" Separately, the FBI issued a public warning (reported around late May 2026) that cybercriminals were spoofing FIFA websites via typosquatting to harvest personal data and sell fake tickets, hospitality packages and products; AFP coverage cited roughly three dozen such domains flagged by the Bureau, with examples including lookalike names such as \"fifa-ticket.live\" and \"fifaworldcup26.sale.\" Los Angeles County Sheriff's Department issued a parallel public warning in June 2026 describing fake ticket sales, hospitality packages, merchandise, streaming services and betting promotions, specifically flagging requests for payment in cryptocurrency as a red flag because such transfers cannot be reversed.","heading":"Scale of Fake-Domain and Phishing Infrastructure","sources":[{"url":"https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/","name":"Infosecurity Magazine: Thousands of Fake FIFA Domains Target World Cup Fans","type":"news_article","credibility":2},{"url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns","name":"Decrypt: World Cup Crypto Scams Are Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","credibility":2},{"url":"https://www.techrepublic.com/de/article/news-fake-fifa-world-cup-sites-fbi-warning/","name":"techrepublic.com: FBI Warning: World Cup Scammers Are Spoofing FIFA Tickets, Job Sites","type":"news_article","credibility":2}],"severity":"high"},{"content":"Group-IB attributed a cluster of over 300 active phishing domains to a Chinese-speaking, profit-driven threat actor it calls GHOST STADIUM, first observed in November 2025. The group's phishing kit closely replicates fifa.com, including FIFA's genuine single sign-on login flow (run by PingIdentity) down to a copied client ID, and loads images directly from FIFA's own content servers to evade detection. Chinese-language code comments and an 11-language interface (including three Chinese variants) were cited as evidence of a Chinese-speaking developer. The group's primary distribution channel was paid Facebook advertising offering discounted or scarce tickets with false urgency; shared Meta ad-tracking identifiers reportedly linked hundreds of domains to common ad accounts. A notable alleged feature is that the fake login page also offers a password-reset flow, which researchers said could let attackers lock victims out of their genuine FIFA accounts and resell any tickets tied to them. Group-IB estimated premium and hospitality ticket fraud alone could cost victims between $71 million and $474 million, with total losses across all fraud tiers potentially reaching into the billions; these figures are the firm's own modeled estimates rather than confirmed losses.","heading":"GHOST STADIUM Threat Actor and Phishing Kit","sources":[{"url":"https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/","name":"Infosecurity Magazine: Thousands of Fake FIFA Domains Target World Cup Fans","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html","name":"The Hacker News: FIFA World Cup 2026 Scams Are Already Live","type":"news_article","credibility":2}],"severity":"high"},{"content":"TRM Labs, an on-chain analytics firm, published a report (dated June 11, 2026, with data as of June 8, 2026) tracking early crypto-related World Cup scams. It identified a Polygon/Ethereum address tied to a fake ticketing site that had received about $1,562, almost entirely on April 1, 2026, plus a separate Bitcoin address for a live but unfunded fake-ticket phishing site, and a Bitcoin address tied to a fixed-match betting scheme that received small payments from apparent individual victims between January and May 2026. Funds from the ticket-scam address were reportedly moved through cross-chain swaps toward the Tron network. TRM noted that, across all fraud generally (not specific to the World Cup), roughly $35 billion flowed to fraud-linked wallets in 2025, and that cumulative scam funds moved through bridges over time total roughly $1.9 billion. Separately, security firm Forcepoint described a phishing email impersonating the crypto-friendly platform Stake.com that led to a wallet-draining page which, once a victim approved a transaction, allowed the attacker to irreversibly withdraw funds. As of the TRM report, confirmed on-chain losses tied to identified World Cup-themed scam addresses totaled under $1,700, substantially lower than researchers' broader projected exposure.","heading":"Cryptocurrency Payment Integration and Wallet Drainers","sources":[{"url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup","name":"TRM Labs: Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","credibility":2},{"url":"https://www.forcepoint.com/blog/x-labs/world-cup-2026-scams","name":"Forcepoint: World Cup 2026 Scams: Phishing, Crypto Drainers and Ticket Fraud","type":"research","credibility":2}],"severity":"medium"},{"content":"Kaspersky researchers reported that fake World Cup live-streaming apps distributed outside Google Play were bundled with two Android banking trojan families, \"Massiv\" and \"Perseus.\" Perseus, built on leaked code from the older Cerberus trojan, was reported to be capable of reading note-taking apps for saved passwords and cryptocurrency seed/recovery phrases, in addition to standard banking-trojan functions such as overlay attacks, keystroke logging, and interception of SMS/authenticator one-time codes. ThreatFabric separately reported a spike in malicious unofficial streaming apps impersonating the popular RojaDirecta service around the Champions League final, which it expected to be repeated at larger scale during the World Cup. A newer malware-as-a-service family called BTMOB was identified in May 2026 inside fake World Cup streaming apps, which researchers said lowered the technical bar for running such campaigns. Group-IB separately described bogus streaming sites that charge a subscription fee and then install malware giving the operator remote control of the device. These loss and infection figures are based on identified malicious infrastructure and app samples rather than confirmed victim counts.","heading":"Android Banking Malware and Seed-Phrase Theft in Fake Streaming Apps","sources":[{"url":"https://rescana.com/post/active-exploitation-alert-fifa-world-cup-2026-targeted-by-fake-ticket-sites-banking-malware-and-credential-theft","name":"Rescana: Active Exploitation Alert: FIFA World Cup 2026 Targeted by Fake Ticket Sites, Banking Malware, and Credential Theft","type":"research","credibility":2},{"url":"https://thenextweb.com/news/fifa-world-cup-2026-scams-phishing-malware","name":"TheNextWeb: FIFA World Cup 2026 is a cybercriminal's dream, and the scams are already live","type":"news_article","credibility":2}],"severity":"high"},{"content":"On-chain analytics firm Bubblemaps alleged that a token marketed under the ticker WCUP showed signs of insider concentration and manipulation: approximately 95% of supply was reportedly seized within the opening minutes by more than 30 newly created wallets, funded shortly beforehand by multiple centralized exchanges and with no prior on-chain history. The token's market capitalization reportedly peaked at around $50 million before tokens were distributed to over 2,500 addresses via a Uniswap router. Bubblemaps said the project's own documentation only vaguely described presale and partner allocations, and that no verified connection to a named team was found on-chain; these are Bubblemaps' allegations and have not been independently adjudicated. A separate, unrelated token called $WORLDCUP (also described as \"World Cup Coin\") was listed on the lower-tier exchange LBank; TRM Labs described it as a fan-made commemorative coin with no FIFA affiliation, carrying standard low-liquidity pump-and-dump risk rather than confirmed fraud. Malwarebytes and other researchers separately catalogued numerous additional crypto projects using World Cup or FIFA branding or imagery without any genuine affiliation, including ones advertising \"Mega Airdrop\" promotions tied to the 48 qualified national teams; FIFA itself is not affiliated with any of the identified tokens.","heading":"Memecoin and Fake Token Schemes: WCUP and $WORLDCUP","sources":[{"url":"https://bitcoinworld.co.in/world-cup-token-wcup-scam-bubblemaps/","name":"Bitcoin World: World Cup Token WCUP Scam Bubblemaps","type":"research","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup","name":"TRM Labs: Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","credibility":2}],"severity":"high"},{"content":"In late April 2026, a threat actor posted on a cybercrime forum (PwnForums) claiming to have breached the Asian Football Confederation (AFC) and Saudi club Al Nassr FC, describing it as among the largest breaches in football history. Secondary reporting cited figures of roughly 69,000 players and 81,000 staff potentially affected, with alleged leaked data including passport copies, contracts, email addresses and tournament registration files; samples reportedly included legal names, dates of birth, nationalities, AFC IDs, club affiliations and venue data. Players reported as potentially named in the leak included Cristiano Ronaldo, Sadio Mané and Aymeric Laporte, all affiliated with Al Nassr. A poster claimed loose ties to the ShinyHunters hacking collective, though no affiliation was independently confirmed, and researchers at Dataminr assessed the actor as more likely an opportunistic financially-motivated individual. As of the most recent reporting found, the AFC had not issued a public statement confirming or denying the breach. This incident is not itself described in available sourcing as cryptocurrency-related, but researchers noted the stolen personal and identity data could feed into subsequent phishing, fraud and crypto-targeted social engineering ahead of the tournament.","heading":"Associated Data Breaches: Alleged AFC and Al Nassr FC Leak","sources":[{"url":"https://www.scworld.com/brief/asian-football-confederation-reportedly-suffers-massive-data-breach","name":"SC World: Asian Football Confederation reportedly suffers massive data breach","type":"news_article","credibility":2},{"url":"https://www.dataminr.com/resources/intel-brief/al-nassr-fc-and-afc-database-llegedly-leaked/","name":"Dataminr: Al Nassr FC and AFC database allegedly leaked","type":"research","credibility":2},{"url":"https://incyber.org/en/article/massive-data-breach-hits-asian-football-two-months-before-the-world-cup/","name":"Incyber: Massive data breach hits Asian football two months before the World Cup","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Researchers at CUJO AI and others identified campaigns using domains posing as official FIFA recruitment or career portals, which solicited corporate login credentials, passport images and national ID scans from job applicants. Fraudsters were also reported to have used real FIFA staff names and photographs sourced from LinkedIn to stage fake job interviews, including over messaging apps such as WhatsApp and Telegram; FIFA has stated it never requests payment or financial details from job applicants and does not conduct interviews over such channels. OCCRP separately reported warnings from anti-trafficking organizations about labor exploitation and human trafficking risks tied to fraudulent World Cup employment and hospitality offers. Group-IB's GHOST STADIUM and related schemes distributed fake ticket offers primarily via paid Facebook advertising, with Meta ad-account tracking identifiers linking large clusters of fraudulent domains together. These employment-fraud reports describe credential and identity-document theft rather than direct cryptocurrency payment demands, though researchers note the harvested personal and financial data can be repurposed for subsequent crypto-targeted scams.","heading":"Social Media Impersonation and Fake Employment/Job Portals","sources":[{"url":"https://www.hrgrapevine.com/us/content/article/2026-06-23-how-cyber-criminals-are-using-world-cup-fever-to-scam-employees-employers","name":"HR Grapevine: How cyber criminals are using World Cup fever to scam employees and employers","type":"news_article","credibility":2},{"url":"https://www.occrp.org/en/news/warnings-of-human-trafficking-issued-for-2026-fifa-world-cup","name":"OCCRP: Warnings of Human Trafficking Issued for 2026 FIFA World Cup","type":"news_article","credibility":2},{"url":"https://malwaretips.com/blogs/?p=406487","name":"MalwareTips: Fake FIFA World Cup Jobs Site Steals Passports","type":"news_article","credibility":3}],"severity":"medium"},{"content":"The FBI publicly warned, in reporting dated around late May 2026, that cybercriminals were spoofing FIFA websites via typosquatted domains to steal personal data, sell counterfeit tickets and hospitality packages, and potentially conduct further fraud; AFP's coverage cited roughly three dozen flagged domains. The Los Angeles County Sheriff's Department issued a separate consumer warning in early June 2026 covering fake ticket sales, hospitality packages, merchandise, streaming subscriptions and betting promotions, explicitly flagging cryptocurrency payment requests as a red flag given the irreversibility of such transfers, and directed victims to file reports with the FBI's Internet Crime Complaint Center (IC3.gov). TRM Labs, Group-IB, Malwarebytes, Kaspersky, ThreatFabric, Forcepoint and Check Point all published independent advisories between roughly May and June 2026 documenting overlapping but distinct scam typologies tied to the tournament. No single report available in open sources used the specific term \"FIFA World Cup 2026 Crypto Streaming Scam Network\" to describe a unified organization; rather, the available evidence describes multiple independent, loosely thematically-linked scam operations exploiting World Cup branding across ticketing, streaming, memecoin, phishing and employment-fraud vectors.","heading":"Law Enforcement and Industry Warnings","sources":[{"url":"https://www.aarp.org/money/scams-fraud/world-cup-ticket-scams/","name":"AARP: World Cup Ticket Scams","type":"news_article","credibility":2},{"url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns","name":"Decrypt: World Cup Crypto Scams Are Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html","name":"Check Point via The Hacker News: FIFA World Cup 2026 Scams Are Already Live","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2025-08","event":"Group-IB observes registration of fraudulent FIFA-impersonating domains beginning, eventually totaling more than 4,300 by the time of its report.","source":"Infosecurity Magazine","source_url":"https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/"},{"date":"2025-11","event":"Group-IB first observes the threat actor it designates GHOST STADIUM.","source":"Infosecurity Magazine","source_url":"https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/"},{"date":"2026-04-01","event":"A fake World Cup ticketing site's Polygon address receives the bulk of the roughly $1,562 it collected, per TRM Labs.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup","date_evidence":"The Polygon side received about USD 1,562, nearly all of it on April 1, 2026."},{"date":"2026-04","event":"A threat actor posts on cybercrime forum PwnForums alleging a breach of the Asian Football Confederation and Al Nassr FC, exposing player and staff data including passports and contracts.","source":"SC World / Dataminr","source_url":"https://www.scworld.com/brief/asian-football-confederation-reportedly-suffers-massive-data-breach"},{"date":"2026-05","event":"Malwarebytes publishes research describing an active 'World Cup scam economy' including fake crypto tokens, travel, merchandise and prediction scam sites.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistl"},{"date":"2026-05","event":"FBI warns publicly that cybercriminals are spoofing FIFA websites via typosquatting to steal data and sell fake tickets and packages.","source":"TechRepublic","source_url":"https://www.techrepublic.com/de/article/news-fake-fifa-world-cup-sites-fbi-warning/"},{"date":"2026-05-27","event":"Group-IB publishes its 'Ghost Stadium' research naming the threat actor and detailing the fake-domain campaign; Infosecurity Magazine reports on it the same day.","source":"Infosecurity Magazine","source_url":"https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/","date_evidence":"The article was published on 27 May 2026."},{"date":"2026-06","event":"Los Angeles County Sheriff's Department issues a public warning on fake World Cup ticket, hospitality, merchandise, streaming and betting scams, flagging cryptocurrency payment requests as a red flag.","source":"Decrypt","source_url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns","date_original":"2026-06-04"},{"date":"2026-06-11","event":"TRM Labs publishes its report on crypto scams targeting World Cup 2026 fans, tracking ticket-scam, fixed-match betting and memecoin addresses.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup","date_evidence":"TRM Labs blog, published June 11, 2026, with data as of June 8, 2026"},{"date":"2026-06","event":"Bubblemaps alleges insider wallet concentration and manipulation in the WCUP token, which reportedly peaked at roughly $50 million market capitalization.","source":"Bitcoin World","source_url":"https://bitcoinworld.co.in/world-cup-token-wcup-scam-bubblemaps/"},{"date":"2026-06","event":"Kaspersky and ThreatFabric report Android banking malware (Massiv, Perseus) and malware-as-a-service family BTMOB distributed via fake World Cup streaming apps.","source":"Rescana","source_url":"https://rescana.com/post/active-exploitation-alert-fifa-world-cup-2026-targeted-by-fake-ticket-sites-banking-malware-and-credential-theft"},{"date":"2026-06-23","event":"HR Grapevine reports on fake FIFA recruitment and job-portal scams targeting employees and employers.","source":"HR Grapevine","source_url":"https://www.hrgrapevine.com/us/content/article/2026-06-23-how-cyber-criminals-are-using-world-cup-fever-to-scam-employees-employers","date_evidence":"2026-06-23-how-cyber-criminals-are-using-world-cup-fever-to-scam-employees-employers"}],"sources_used":[{"url":"https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/","name":"Infosecurity Magazine: Thousands of Fake FIFA Domains Target World Cup Fans","type":"news_article","archive_url":"http://web.archive.org/web/20261011193002/https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/","credibility":2,"archive_timestamp":"2026-10-11T19:30:02+00:00"},{"url":"https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html","name":"The Hacker News: FIFA World Cup 2026 Scams Are Already Live","type":"news_article","archive_url":"http://web.archive.org/web/20261012060235/https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html","credibility":2,"archive_timestamp":"2026-10-12T06:02:35+00:00"},{"url":"https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup","name":"TRM Labs: Tracking Crypto Scammers Ahead of the 2026 World Cup","type":"research","archive_url":"http://web.archive.org/web/20261014205818/https://www.trmlabs.com/resources/blog/tracking-crypto-scammers-ahead-of-the-2026-world-cup","credibility":2,"archive_timestamp":"2026-10-14T20:58:18+00:00"},{"url":"https://www.forcepoint.com/blog/x-labs/world-cup-2026-scams","name":"Forcepoint: World Cup 2026 Scams: Phishing, Crypto Drainers and Ticket Fraud","type":"research","archive_url":"http://web.archive.org/web/20261014204723/https://www.forcepoint.com/blog/x-labs/world-cup-2026-scams","credibility":2,"archive_timestamp":"2026-10-14T20:47:23+00:00"},{"url":"https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns","name":"Decrypt: World Cup Crypto Scams Are Targeting Soccer Fans, Law Enforcement Warns","type":"news_article","archive_url":"http://web.archive.org/web/20261023203922/https://decrypt.co/369919/world-cup-crypto-scams-targeting-soccer-fans-law-enforcement-warns","credibility":2,"archive_timestamp":"2026-10-23T20:39:22+00:00"},{"url":"https://www.techrepublic.com/de/article/news-fake-fifa-world-cup-sites-fbi-warning/","name":"TechRepublic: FBI Warning: World Cup Scammers Are Spoofing FIFA Tickets, Job Sites","type":"news_article","archive_url":"https://web.archive.org/web/20261106091155/https://www.techrepublic.com/de/article/news-fake-fifa-world-cup-sites-fbi-warning/","credibility":2,"archive_timestamp":"2026-11-06T09:11:55+00:00"},{"url":"https://rescana.com/post/active-exploitation-alert-fifa-world-cup-2026-targeted-by-fake-ticket-sites-banking-malware-and-credential-theft","name":"Rescana: Active Exploitation Alert: FIFA World Cup 2026 Targeted by Fake Ticket Sites, Banking Malware, and Credential Theft","type":"research","archive_url":"http://web.archive.org/web/20261011192151/https://www.rescana.com/post/active-exploitation-alert-fifa-world-cup-2026-targeted-by-fake-ticket-sites-banking-malware-and-credential-theft","credibility":2,"archive_timestamp":"2026-10-11T19:21:51+00:00"},{"url":"https://thenextweb.com/news/fifa-world-cup-2026-scams-phishing-malware","name":"TheNextWeb: FIFA World Cup 2026 is a cybercriminal's dream, and the scams are already live","type":"news_article","archive_url":"http://web.archive.org/web/20261011193502/https://thenextweb.com/news/fifa-world-cup-2026-scams-phishing-malware","credibility":2,"archive_timestamp":"2026-10-11T19:35:02+00:00"},{"url":"https://bitcoinworld.co.in/world-cup-token-wcup-scam-bubblemaps/","name":"Bitcoin World: World Cup Token WCUP Scam Bubblemaps","type":"research","archive_url":"http://web.archive.org/web/20260727230859/https://bitcoinworld.co.in/world-cup-token-wcup-scam-bubblemaps/","credibility":2,"archive_timestamp":"2026-07-27T23:08:59+00:00"},{"url":"https://www.scworld.com/brief/asian-football-confederation-reportedly-suffers-massive-data-breach","name":"SC World: Asian Football Confederation reportedly suffers massive data breach","type":"news_article","archive_url":"http://web.archive.org/web/20261015131944/https://www.scworld.com/brief/asian-football-confederation-reportedly-suffers-massive-data-breach","credibility":2,"archive_timestamp":"2026-10-15T13:19:44+00:00"},{"url":"https://www.dataminr.com/resources/intel-brief/al-nassr-fc-and-afc-database-llegedly-leaked/","name":"Dataminr: Al Nassr FC and AFC database allegedly leaked","type":"research","archive_url":"http://web.archive.org/web/20261015132041/https://www.dataminr.com/resources/intel-brief/al-nassr-fc-and-afc-database-llegedly-leaked/","credibility":2,"archive_timestamp":"2026-10-15T13:20:41+00:00"},{"url":"https://incyber.org/en/article/massive-data-breach-hits-asian-football-two-months-before-the-world-cup/","name":"Incyber: Massive data breach hits Asian football two months before the World Cup","type":"news_article","archive_url":"http://web.archive.org/web/20260429083701/https://incyber.org/en/article/massive-data-breach-hits-asian-football-two-months-before-the-world-cup/","credibility":2,"archive_timestamp":"2026-04-29T08:37:01+00:00"},{"url":"https://www.hrgrapevine.com/us/content/article/2026-06-23-how-cyber-criminals-are-using-world-cup-fever-to-scam-employees-employers","name":"HR Grapevine: How cyber criminals are using World Cup fever to scam employees and employers","type":"news_article","archive_url":"http://web.archive.org/web/20261003025413/https://www.hrgrapevine.com/us/content/article/2026-06-23-how-cyber-criminals-are-using-world-cup-fever-to-scam-employees-employers","credibility":2,"archive_timestamp":"2026-10-03T02:54:13+00:00"},{"url":"https://www.occrp.org/en/news/warnings-of-human-trafficking-issued-for-2026-fifa-world-cup","name":"OCCRP: Warnings of Human Trafficking Issued for 2026 FIFA World Cup","type":"news_article","archive_url":"http://web.archive.org/web/20260618112937/https://www.occrp.org/en/news/warnings-of-human-trafficking-issued-for-2026-fifa-world-cup","credibility":2,"archive_timestamp":"2026-06-18T11:29:37+00:00"},{"url":"https://malwaretips.com/blogs/?p=406487","name":"MalwareTips: Fake FIFA World Cup Jobs Site Steals Passports","type":"news_article","archive_url":"https://web.archive.org/web/20261106093803/https://malwaretips.com/blogs/fake-fifa-world-cup-jobs-scam/","credibility":3,"archive_timestamp":"2026-11-06T09:38:03+00:00"},{"url":"https://www.aarp.org/money/scams-fraud/world-cup-ticket-scams/","name":"AARP: World Cup Ticket Scams","type":"news_article","archive_url":"http://web.archive.org/web/20261015131806/https://www.aarp.org/money/scams-fraud/world-cup-ticket-scams/","credibility":2,"archive_timestamp":"2026-10-15T13:18:06+00:00"},{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/05/the-2026-world-cup-scam-economy-is-already-running-before-the-first-whistl","name":"Malwarebytes: The 2026 World Cup scam economy is already running before the first whistle","type":"research","archive_url":null,"credibility":2,"archive_timestamp":null}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-06-23T23:36:35.456815+00:00","updated_at":"2026-11-06T09:46:49.667376+00:00"},"source_quality":{"total":17,"tier1":0,"tier2":2,"tier3":0,"unrated":15},"follower_count":null,"content_updated_at":"2026-11-03T23:07:40.522Z","last_fact_checked_at":"2026-10-27T11:19:48.982Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}