Skip to main content
AVOID.NET
Sign in

FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure

avoid.net/fifa-world-cup-2026-crypto-phishing-and-typosquatting-infrastructure→0/100·93% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2kxwhv…K1Ly

Summary

A coordinated, multi-actor scam infrastructure emerged around the 2026 FIFA World Cup (hosted across Canada, Mexico, and the United States, June 11 to July 19, 2026), comprising more than 13,000 to 19,000 registered World Cup-themed domains of which approximately 8.8% have been flagged as malicious or suspicious. The infrastructure combines typosquatted FIFA domains, AI-generated fake ticketing portals, cryptocurrency wallet drainers, seed-phrase phishing kits, and Android banking trojans, with at least one threat actor cluster — designated GHOST STADIUM — attributed to Chinese-speaking operators. The FBI issued a formal public service announcement on May 27, 2026, warning consumers and reporting at least 36 confirmed fraudulent domains spoofing official FIFA web properties.

Connected Entities

8 entities · 60 linked investigations
Organizations
□Polygon54□Ethereum□wallet drainers□Binance□Monero
Protocols
⌂FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure
Tokens
♦Bitcoin♦Litecoin
Relationships
  • FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Polygon(80%)
  • FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Monero(60%)
  • FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Bitcoin(70%)
  • FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Ethereum(60%)
  • FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Litecoin(60%)
  • FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure→mentioned with→Binance(60%)
  • Ethereum→mentioned with→Bitcoin(60%)
  • wallet drainers→mentioned with→Ethereum(70%)
  • Monero→mentioned with→Binance(70%)
  • Monero→mentioned with→Bitcoin(60%)
  • + 6 more
Also appears in
Polygon·54StableMagnet·2Shibarium·28JUDAO·18Shibarium Bridge·32Andean Medjedovic·2Ionic Money·14Allo Protocol·57AnubisDAO·2SushiSwap RouteProcessor Exploit·54+ 50 more

Connected Through

7 shared actors · 620 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about FIFA World Cup 2026 Crypto Phishing and Typosquatting Infrastructure?

Timeline(13 events)

August 2025

GHOST STADIUM begins registering fraudulent FIFA domains; Group-IB first observes the threat actor cluster

Group-IB Blog

17 November 2025

First major GHOST STADIUM domain registration wave identified by Hunt.io infrastructure analysis

Hunt.io

2026

FortiGuard Labs begins observing rapid accumulation of World Cup-themed domain registrations; count reaches 13,000+ by May

Fortinet FortiGuard Labs

20 March 2026

Second major GHOST STADIUM domain registration wave, March 20-31; 78 domain registrations recorded in March overall

CybelAngel Threat Report

April 2026

TRM Labs-tracked Polygon wallet address receives approximately $1,562 from fake ticketing scam victims

TRM Labs

27 April 2026

Threat actor claiming ShinyHunters affiliation publishes alleged AFC and Al Nassr FC database containing 150,000+ passport records and player contracts on a cybercrime forum

TechRadar

29 April 2026

Single-day peak: 30 fraudulent FIFA domain registrations observed in one day

CybelAngel Threat Report

27 May 2026

FBI IC3 issues PSA I-052726-PSA formally warning consumers about FIFA website spoofing and identifying at least 36 fraudulent domains

FBI Internet Crime Complaint Center

8 June 2026

Help Net Security reports Intel 471 assessment that 2026 FIFA World Cup represents 'the largest and most complex cyberattack surface in sporting history'; total domain count cited at 19,000+

Help Net Security

9 June 2026

CybelAngel publishes threat report documenting 468 indicators of compromise across four fraud vectors, with 125 clone domains actively live

CybelAngel

9 June 2026

Arctic Wolf Labs publishes research on adversary-in-the-middle (AiTM) phishing kit defeating all FIFA account MFA methods in real time

Arctic Wolf Labs

10 June 2026

WCUP (World Cup PvP) memecoin launches; reaches approximately $50 million market cap on day one following alleged undisclosed paid promotions by crypto influencers on X

TRM Labs / AMBCrypto

11 June 2026

2026 FIFA World Cup tournament begins; scam infrastructure already fully operational across all documented vectors

The Hacker News
Provenance & Audit Trail
Anchored on SolanaVerify on-chain19 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 19 of 20 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 8/9/2026, 12:35:23 PM

last updated: 8/25/2026, 7:40:53 PM

5 views

avoid.net — verified advice for a post-truth world