FIFA World Cup 2026 Crypto Streaming Scam Network
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·27sVEP…f8LySummary
A coordinated network of fraudulent websites, malicious streaming applications, phishing campaigns, and deceptive cryptocurrency schemes targeting FIFA World Cup 2026 fans across at least six fraud typologies. The campaign encompasses more than 4,300 registered fraudulent domains, Android banking trojans embedded in fake streaming apps, a Chinese-speaking threat actor designated GHOST STADIUM operating 300+ pixel-perfect FIFA clones, and at least one fan-branded token (WCUP) alleged to be a pump-and-dump scheme. The FBI issued a public service announcement on May 27, 2026; estimated losses from ticket fraud alone range from $71 million to $474 million, with total campaign potential described by Group-IB as reaching into the billions.
Connected Entities
6 entities · 60 linked investigations- FIFA World Cup 2026 Crypto Streaming Scam Network→mentioned with→Binance(60%)
- FIFA World Cup 2026 Crypto Streaming Scam Network→mentioned with→Litecoin(60%)
- FIFA World Cup 2026 Crypto Streaming Scam Network→mentioned with→Bitcoin(70%)
- FIFA World Cup 2026 Crypto Streaming Scam Network→mentioned with→Monero(60%)
- FIFA World Cup 2026 Crypto Streaming Scam Network→mentioned with→Polygon(70%)
- Monero→mentioned with→Binance(70%)
- Monero→mentioned with→Bitcoin(60%)
- Litecoin→mentioned with→Bitcoin(70%)
- Litecoin→mentioned with→Monero(65%)
- Polygon→mentioned with→Binance(70%)
Timeline(16 events)
2019
Domain fifa[.]city, later incorporated into the GHOST STADIUM campaign, is registered and begins operating, according to Group-IB.
Group-IB BlogAugust 2025
Group-IB records the start of systematic fraudulent domain registrations impersonating FIFA ahead of the 2026 World Cup, with 4,300+ such domains eventually catalogued.
Group-IB BlogNovember 2025
Group-IB first observes the GHOST STADIUM threat actor operating phishing infrastructure targeting FIFA World Cup fans.
Group-IB Blog2026
FortiGuard Labs begins counting World Cup-themed domain registrations; by May 2026, more than 13,000 such domains are recorded, approximately 8.8% assessed as malicious or suspicious.
FIFA World Cup 2026 Scams Surge As Fake Sites Target Fans — CybleFebruary 2026
First derivatives of the Massiv Android banking trojan are spotted embedded in pirated World Cup streaming applications, according to Malwarebytes.
FIFA World Cup 2026 Scams Are Already Live — The Hacker NewsMarch 2026
GHOST STADIUM domain registrations surge: 78 new domains registered in March 2026 alone, according to CybelAngel.
FIFA World Cup Fraud: 468 IOCs and Four Active Threat Vectors — CybelAngelApril 2026
A Polygon wallet linked to a fake FIFA ticket phishing site receives approximately $1,562 in a single day, the largest single-day inflow TRM Labs documented across four tracked fraud wallets.
Tracking Crypto Scammers Ahead of the 2026 World Cup — TRM Labs27 April 2026
A coordinated batch of GHOST STADIUM redirector domains is registered in a single day, including football-ticket[.]top, football-ticket[.]shop, football-game[.]shop, and football-tickets[.]top.
GHOST STADIUM Score: Billions At Stake — Group-IB29 April 2026
A second coordinated domain registration event registers 30 additional GHOST STADIUM domains in a single day, according to CybelAngel.
FIFA World Cup Fraud: 468 IOCs and Four Active Threat Vectors — CybelAngel27 May 2026
FBI/IC3 issues Public Service Announcement I-052726-PSA warning of spoofed FIFA websites, documenting over 40 fraudulent domains and advising consumers to report incidents to ic3.gov.
IC3 PSA I-052726-PSA — FBI27 May 2026
Group-IB publishes the GHOST STADIUM research report, attributing the campaign to a Chinese-speaking threat actor and estimating potential losses of $71 million to $474 million for the premium ticket fraud tier alone.
GHOST STADIUM Score: Billions At Stake — Group-IB9 June 2026
CybelAngel confirms 344 clone domains actively mimicking the official FIFA website, with 125 live and serving content; 146 use Cloudflare nameservers to resist IP-level blocking.
FIFA World Cup Fraud: 468 IOCs and Four Active Threat Vectors — CybelAngel10 June 2026
WCUP token launches on LBank; Bubblemaps alleges 95% of supply was sniped at launch by more than 30 coordinated wallets funded from an exchange 30 minutes prior; market cap reaches approximately $50 million against only $536,000 in liquidity.
95% Of World Cup Token WCUP Supply Pre-Purchased By Single Group, Bubblemaps Alleges — BitcoinWorld11 June 2026
FIFA World Cup 2026 tournament begins, marking the opening of the highest-risk window for scam activity. Researchers designate June 11 through July 19, 2026 as the peak fraud period.
FIFA World Cup 2026 Scams Are Already Live — The Hacker News15 June 2026
CybelAngel publishes full threat report cataloguing 468 indicators of compromise across four active fraud vectors.
FIFA World Cup Fraud: 468 IOCs and Four Active Threat Vectors — CybelAngel23 June 2026
Malwarebytes, Help Net Security, and Tech-ish publish reports on fake streaming site networks, with Malwarebytes documenting more than 40 functionally identical scam streaming websites active during the tournament.
Free, no-signup World Cup streams serve scams instead of football — Help Net SecurityDecision Log
- hash: 6tA3rJxdsWSFG5JzeHB1vGcDXCTqY5uhcJJNMsERyTTr
This investigation is cryptographically anchored to the Solana blockchain (1 event). 27 of 28 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/23/2026, 11:36:35 PM
last updated: 7/27/2026, 11:22:31 PM
4 viewsavoid.net — verified advice for a post-truth world