Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Ghost Stadium FIFA World Cup fraud campaign

Campaign
First reported
Last updated
Happening score
H score 39
1 unique sources, 1 articles

Summary

Hide ▲

A Ghost Stadium fraud campaign has registered 4,300+ FIFA lookalike domains and is using paid Facebook ads to funnel 2026 FIFA World Cup fans into phishing and ticket scams. The operation clones fifa.com, mimics PingIdentity SSO, and uses shared tracking infrastructure to make the sites look legitimate. Group-IB says the broader event involves four independent threat actors running multiple fraud schemes at once, with most domains still dormant until demand peaks. The campaign has also fed credential theft, with roughly 2,500 FIFA logins already circulating on dark-web markets.

Related Happenings

FIFA logins traded on dark-web markets

Data Leak
First: 27.05.2026 14:28 Last: 27.05.2026 14:28 Sources 1

How related: Dominated by the Vidar and Lumma infostealer families, those infections have swept up around 2500 FIFA logins now trading on dark-web markets.

About this happening: Around **2,500 FIFA logins** have surfaced on **dark-web markets**, turning stolen credentials into an active exposure that can fuel account abuse and downstream fraud. The leak i...

Open Happening

AccountDumpling Google AppSheet Facebook phishing campaign

Campaign
First: 01.05.2026 21:09 Last: 01.05.2026 21:09 Sources 1

About this happening: A **Vietnamese-linked** operation dubbed **AccountDumpling** is using **Google AppSheet** as a phishing relay to steal **Facebook** credentials, enabling account takeover at scale...

Open Happening

Fake shipment tracking SMS phishing campaign

Campaign
First: 16.03.2026 16:45 Last: 16.03.2026 16:45 Sources 1

About this happening: A **global surge** in **fake shipment tracking phishing campaigns** is stealing **funds and credentials** at scale, with activity rising from almost none in 2024 to **over 100 cam...

Open Happening

Meta rolls out anti-scam protections and AI scam detection across WhatsApp, Facebook, and Messenger

Security Tool/Service
First: 11.03.2026 15:29 Last: 11.03.2026 15:29 Sources 1

About this happening: Meta is rolling out **anti-scam protections** across **WhatsApp, Facebook, and Messenger**, using warnings and AI detection to block scams before users engage. The updates target...

Open Happening

Global HYIP scam campaign using fake investment sites and social media

Campaign
First: 02.02.2026 17:34 Last: 02.02.2026 17:34 Sources 1

About this happening: A **global HYIP scam campaign** is using **4,200+ fake investment websites** and **social-media promotion** to solicit deposits, creating sustained fraud risk for investors and ma...

Open Happening

Timeline

  1. 27.05.2026 14:28 2 articles · 11h ago

    Group-IB maps a FIFA impersonation fraud campaign targeting 2026 World Cup fans

    Initial Disclosure

    Group-IB mapped a fraud operation targeting fans of the 2026 FIFA World Cup, with more than 4,300 FIFA impersonation domains, cloned fifa.com pages that mimic PingIdentity SSO, paid Facebook ads, and a broader ecosystem that also includes credential theft and ticket fraud.

    Show sources
    Open in new tab