Cybercriminals are actively targeting the upcoming FIFA World Cup 2026, establishing infrastructure and launching various scams to exploit the event's global appeal, according to research from FortiGuard Labs. The tournament, set to begin on June 11, 2026, is expected to attract significant attention and drive a high volume of digital transactions, creating a fertile ground for malicious actors.
Research indicates that threat actors are not waiting for the event to commence. Between January and May 2026, over 13,000 new domains related to the FIFA World Cup 2026 were registered. Analysis revealed that approximately 8.8% of these domains are malicious or suspicious, suggesting a proactive and widespread effort by cybercriminals.
The threat landscape includes a wide array of scams, with fake ticketing websites being a prominent concern. These counterfeit sites often mimic official FIFA pages, aiming to harvest personal information, login credentials, and payment data. Scammers capitalize on the scarcity of tickets and the urgency of fans seeking resale options, often promoting fake discounts to pressure victims into quick, ill-considered purchases. Some campaigns have also bundled fraudulent tickets with counterfeit travel and accommodation packages to enhance their perceived legitimacy.
Social media impersonation is another significant tactic. FortiGuard Labs identified over 1,700 suspected FIFA-related impersonation accounts and channels across various platforms, with nearly 90% on Facebook and Instagram. These accounts are used for fake promotions, ticket scams, distributing fraudulent livestream links, phishing, spreading misinformation, and distributing malware. Their effectiveness stems from their ability to appear within legitimate conversations and direct interactions with fans.
The tournament also presents risks through malicious applications. The research highlights suspicious FIFA-themed Android Package Kit (APK) files found on third-party download sites. These fake or trojanized apps can pose as legitimate streaming tools, betting apps, or score trackers, potentially exposing users to spyware, credential theft, or remote access tools. One detected executable, identified as ‘1xbet.exe,’ exhibited signs of persistence, encrypted communications, and potential ransomware behavior.
Fake job postings are also being used as a lure. With the World Cup generating demand for temporary staff, attackers are posting fraudulent job advertisements and recruitment notices. One identified scheme involved sending calendar invites that directed victims to phishing websites featuring counterfeit login pages for services like Google. Upon entering credentials, victims would receive a generic error message, allowing attackers to capture their information. Multiple domains impersonating FIFA and its sponsors shared a common Google Analytics tracking ID, suggesting a coordinated campaign.
Credential exposure is a heightened risk, with FIFA-related activity detected within stealer log telemetry. Over 4,600 URLs associated with FIFA were found in stealer logs, linked to malware families such as Vidar, LummaC2, and RedLine. The research also uncovered a significant number of exposed credentials, including over 1,500 records from past breach datasets related to FIFA employees and organizational accounts, and over 260 FIFA employee credentials. Additionally, more than 270,000 user and fan credentials from FIFA-related websites were found in stealer log data. While not all exposed accounts may be currently active, this data can facilitate credential stuffing, account takeovers, and targeted phishing attacks.
Organizations involved in sports, travel, hospitality, media, retail, finance, government, transportation, and critical infrastructure are advised to begin their defensive preparations early. Security teams should monitor for lookalike domains, brand impersonation, malicious advertisements, fake social media profiles, and credential leaks. User education is also crucial, reminding fans and employees to use official channels, avoid third-party app downloads, and exercise caution with unsolicited offers.
