With the 2026 FIFA World Cup approaching, the FBI and cybersecurity researchers are warning of a massive surge in World Cup-themed fraud campaigns. Researchers have identified approximately 19,000 FIFA-themed domains created since January 2026, with over 4,300 directly impersonating FIFA’s official website. Many were registered months in advance and activated as demand for tickets and streaming peaked.
A threat group tracked as “GHOST STADIUM” is running sophisticated phishing kits across hundreds of cloned FIFA sites, some replicating FIFA’s single sign-on login page to hijack fan accounts. The fraud operations span fake ticket sales, counterfeit hospitality packages, fraudulent vacation rentals, fake merchandise, fictitious “World Cup Visas,” and scam cryptocurrency tokens. Pirated streaming apps are being used to distribute banking malware targeting fans searching for free match streams.
AI tools are compounding the problem, enabling scammers to generate product images and website clones that pull authentic branding directly from FIFA’s servers, making fraudulent sites increasingly indistinguishable from legitimate ones. The FBI is urging fans to purchase tickets and merchandise exclusively from official sources, type “fifa.com” directly rather than clicking search results, and report scams to IC3.
Source
Reported by The Hacker News, Bitdefender, and Help Net Security.
Commentary
Major sporting events are always a magnet for fraud, but the scale here is unprecedented. Nineteen thousand themed domains is an entire ecosystem of deception, and the GHOST STADIUM operation shows a level of sophistication — replicating SSO login flows — that goes well beyond typical phishing. The AI angle is particularly concerning: when scammers can clone entire brand identities in minutes, the burden of verification shifts entirely to consumers who are least equipped to handle it. If you’re planning to attend or stream the World Cup, treat every unofficial site as hostile. Bookmark the real FIFA site now, use credit cards (never debit), and assume that any deal that seems too good to be true absolutely is.