Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Ghost Stadium FIFA World Cup fraud campaign

Campaign
First reported
Last updated
Happening score
H score 41
3 unique sources, 3 articles

Summary

Hide ▲

A Ghost Stadium-linked FIFA impersonation fraud campaign is targeting 2026 FIFA World Cup fans with cloned fifa.com pages, fake ticket and hospitality offers, and related fraud lures. The FBI warned that criminals are registering typosquatted domains such as fiffa[.]com and using fake employment portals like jobs-fifa[.]com and fifa-hiring[.]com, while Group-IB said the operation uses more than 300 phishing sites and a cloned PingIdentity login flow to steal credentials and take over real accounts. The campaign is spreading through Facebook ads, Google Search, Telegram, and WhatsApp, and it raises the risk of financial loss, identity theft, and fraudulent account creation as World Cup demand peaks.

Related Happenings

FIFA World Cup 2026 pre-positioned fraud campaign

Campaign
H score30 First: 30.06.2026 14:30 Last: 30.06.2026 14:30 Sources 1

About this happening: A **pre-positioned FIFA World Cup 2026 fraud campaign** was already staged before kickoff, widening the risk of **email impersonation**, **fake apps**, and **travel-site spoofing*...

Open Happening

Pre-World Cup 2026 fraud surge across partner spoofing, fake sportsbook apps, and travel domains

Trend
H score31 First: 30.06.2026 14:30 Last: 30.06.2026 14:30 Sources 1

About this happening: **Pre-tournament fraud** around **FIFA World Cup 2026** intensified across **partners, sportsbook users, and travel buyers**, raising the risk of impersonation, payment diversion,...

Open Happening

Booking.com partner accommodation phishing campaign targeting Japan

Campaign
H score32 First: 30.06.2026 13:30 Last: 30.06.2026 13:30 Sources 1

About this happening: A **phishing campaign** is targeting **Booking.com partner accommodations in Japan** with guest-complaint and review-request lures that deliver **malicious files** for **TONResolv...

Open Happening

U.S. Justice Department seizes World Cup piracy domains

Law Enforcement
H score67 First: 29.06.2026 14:21 Last: 29.06.2026 14:21 Sources 1

About this happening: The **U.S. Justice Department's Criminal Division** seized **nearly 400 web domains** tied to **illegal FIFA World Cup streaming**, disrupting a piracy operation built on domain i...

Open Happening

FIFA-themed phishing-as-a-service market selling scam kits and ticket-buying bots

Threat Actor Meta
H score42 First: 05.06.2026 10:01 Last: 05.06.2026 10:01 Sources 1

How related: Group-IB also flagged a "phishing-as-a-service" market that sells ready-made scam kits and ticket-buying bots, so taking down one operator barely helps.

About this happening: A **FIFA-themed phishing-as-a-service market** is selling **ready-made scam kits** and **ticket-buying bots**, lowering the barrier for fraud operators and making takedowns less e...

Open Happening

Timeline

  1. 27.05.2026 14:28 4 articles · 1mo ago

    Group-IB maps a FIFA impersonation fraud campaign targeting 2026 World Cup fans

    Initial Disclosure

    Group-IB mapped a fraud operation targeting fans of the 2026 FIFA World Cup, with more than 4,300 FIFA impersonation domains, cloned fifa.com pages that mimic PingIdentity SSO, paid Facebook ads, and a broader ecosystem that also includes credential theft and ticket fraud.

    Show sources
    Open in new tab