FIFA-themed phishing-as-a-service market selling scam kits and ticket-buying bots
Threat Actor Meta
Summary
Hide ▲
Show ▼
A FIFA-themed phishing-as-a-service market is selling ready-made scam kits and ticket-buying bots, lowering the barrier for fraud operators and making takedowns less effective during the World Cup 2026 scam window. The ecosystem lets multiple buyers reuse the same fraud infrastructure across cloned sites and account-takeover flows. That service model turns one operator’s tooling into a repeatable criminal supply chain. The result is broader ticket theft, credential abuse, and fraud resilience across the event period.
Related Happenings
FBI public service announcement on fake FIFA websites
Public Sector Action
First: 28.05.2026 22:08
Last: 28.05.2026 22:08
Sources 1
How related:
The FBI advisory lists dozens of fake FIFA domains, from misspelled lookalikes to phony FIFA jobs pages, and warns more are coming.
About this happening:
The **FBI** and security researchers warn that **FIFA-themed fraud** is already targeting **World Cup 2026** fans ahead of the **June 11 kickoff**. Reported activity includes **mo...
FBI public service announcement on fake FIFA websites
Public Sector ActionHow related: The FBI advisory lists dozens of fake FIFA domains, from misspelled lookalikes to phony FIFA jobs pages, and warns more are coming.
About this happening: The **FBI** and security researchers warn that **FIFA-themed fraud** is already targeting **World Cup 2026** fans ahead of the **June 11 kickoff**. Reported activity includes **mo...
Ghost Stadium FIFA World Cup fraud campaign
Campaign
First: 27.05.2026 14:28
Last: 27.05.2026 14:28
Sources 1
How related:
At the center is a group it calls GHOST STADIUM, a Chinese-speaking, money-driven operation running one phishing kit across more than 300 of those sites.
About this happening:
A **Ghost Stadium**-linked **FIFA impersonation fraud campaign** is targeting **2026 FIFA World Cup** fans with cloned **fifa.com** pages, fake ticket and hospitality offers, and...
Ghost Stadium FIFA World Cup fraud campaign
CampaignHow related: At the center is a group it calls GHOST STADIUM, a Chinese-speaking, money-driven operation running one phishing kit across more than 300 of those sites.
About this happening: A **Ghost Stadium**-linked **FIFA impersonation fraud campaign** is targeting **2026 FIFA World Cup** fans with cloned **fifa.com** pages, fake ticket and hospitality offers, and...
FIFA logins traded on dark-web markets
Data Leak
First: 27.05.2026 14:28
Last: 27.05.2026 14:28
Sources 1
About this happening:
Around **2,500 FIFA logins** have surfaced on **dark-web markets**, turning stolen credentials into an active exposure that can fuel account abuse and downstream fraud. The leak i...
FIFA logins traded on dark-web markets
Data LeakAbout this happening: Around **2,500 FIFA logins** have surfaced on **dark-web markets**, turning stolen credentials into an active exposure that can fuel account abuse and downstream fraud. The leak i...
Formula 1 fan scam ecosystem campaign
Campaign
First: 25.05.2026 12:00
Last: 25.05.2026 12:00
Sources 1
About this happening:
A coordinated scam ecosystem is targeting **Formula 1 fans** with **fake streaming apps**, **counterfeit merchandise**, and **social-media lures**, creating theft, fraud, and malw...
Formula 1 fan scam ecosystem campaign
CampaignAbout this happening: A coordinated scam ecosystem is targeting **Formula 1 fans** with **fake streaming apps**, **counterfeit merchandise**, and **social-media lures**, creating theft, fraud, and malw...
Albanian scam call centers investment-fraud campaign
Campaign
First: 30.04.2026 13:00
Last: 30.04.2026 13:00
Sources 1
About this happening:
A **two-year investment-fraud campaign** tied to **Albanian scam call centers** has been disrupted after **10 arrests**, revealing a coordinated operation that allegedly stole **a...
Albanian scam call centers investment-fraud campaign
CampaignAbout this happening: A **two-year investment-fraud campaign** tied to **Albanian scam call centers** has been disrupted after **10 arrests**, revealing a coordinated operation that allegedly stole **a...
Timeline
-
05.06.2026 10:01 2 articles · 16h ago
FIFA-themed phishing-as-a-service market sells scam kits and ticket-buying bots
Campaign Scope UpdateA FIFA-themed phishing-as-a-service market is selling ready-made scam kits and ticket-buying bots during the World Cup 2026 scam window, letting multiple operators reuse the same fraud tooling across cloned ticket and login sites. The service model lowers the barrier to entry for ticket theft and makes takedowns of individual operators less effective.
Show sources
- FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins — thehackernews.com — 05.06.2026 10:01
- FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins — thehackernews.com — 05.06.2026 10:01