FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2kxwhv…K1LySummary
A coordinated, multi-actor scam infrastructure emerged around the 2026 FIFA World Cup (hosted across Canada, Mexico, and the United States, June 11 to July 19, 2026), comprising more than 13,000 to 19,000 registered World Cup-themed domains of which approximately 8.8% have been flagged as malicious or suspicious. The infrastructure combines typosquatted FIFA domains, AI-generated fake ticketing portals, cryptocurrency wallet drainers, seed-phrase phishing kits, and Android banking trojans, with at least one threat actor cluster — designated GHOST STADIUM — attributed to Chinese-speaking operators. The FBI issued a formal public service announcement on May 27, 2026, warning consumers and reporting at least 36 confirmed fraudulent domains spoofing official FIFA web properties.
Connected Entities
1 entities · 10 linked investigations- + 2 more
Timeline(13 events)
August 2025
GHOST STADIUM begins registering fraudulent FIFA domains; Group-IB first observes the threat actor cluster
Group-IB Blog17 November 2025
First major GHOST STADIUM domain registration wave identified by Hunt.io infrastructure analysis
Hunt.io2026
FortiGuard Labs begins observing rapid accumulation of World Cup-themed domain registrations; count reaches 13,000+ by May
Fortinet FortiGuard Labs20 March 2026
Second major GHOST STADIUM domain registration wave, March 20-31; 78 domain registrations recorded in March overall
CybelAngel Threat ReportApril 2026
TRM Labs-tracked Polygon wallet address receives approximately $1,562 from fake ticketing scam victims
TRM Labs27 April 2026
Threat actor claiming ShinyHunters affiliation publishes alleged AFC and Al Nassr FC database containing 150,000+ passport records and player contracts on a cybercrime forum
TechRadar29 April 2026
Single-day peak: 30 fraudulent FIFA domain registrations observed in one day
CybelAngel Threat Report27 May 2026
FBI IC3 issues PSA I-052726-PSA formally warning consumers about FIFA website spoofing and identifying at least 36 fraudulent domains
FBI Internet Crime Complaint Center8 June 2026
Help Net Security reports Intel 471 assessment that 2026 FIFA World Cup represents 'the largest and most complex cyberattack surface in sporting history'; total domain count cited at 19,000+
Help Net Security9 June 2026
CybelAngel publishes threat report documenting 468 indicators of compromise across four fraud vectors, with 125 clone domains actively live
CybelAngel9 June 2026
Arctic Wolf Labs publishes research on adversary-in-the-middle (AiTM) phishing kit defeating all FIFA account MFA methods in real time
Arctic Wolf Labs10 June 2026
WCUP (World Cup PvP) memecoin launches; reaches approximately $50 million market cap on day one following alleged undisclosed paid promotions by crypto influencers on X
TRM Labs / AMBCrypto11 June 2026
2026 FIFA World Cup tournament begins; scam infrastructure already fully operational across all documented vectors
The Hacker NewsDecision Log
- hash: EqFMnnsi9zRXwf8LVZs2Mh9AHUiDKWt3bybyCm4KHZ3P
- hash: BX4diz3TFkDXEQ6Pxv1Gjy7G3cnvBigLfk49Z3BLsLSp
- hash: Ei79r9weWmbR52jpi6FebGDQSfu5RTHbPikVCZD1RbFk
This investigation is cryptographically anchored to the Solana blockchain (3 events). 19 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/9/2026, 12:35:23 PM
last updated: 8/25/2026, 7:40:53 PM
5 viewsavoid.net — verified advice for a post-truth world