FIFA 2026 Security Alert: Cybercriminals Exploit Fan Excitement with Mass Phishing
Source AlienVault OTX General
Rated by Threat Radar
Data as of 25 Jun 2026, 20:00 UTC
What to do
AI-suggested
Users should be advised to only use official FIFA channels for ticket purchases and tournament information. Organizations and individuals should educate users about phishing risks, verify URLs carefully, and avoid providing personal or payment information on suspicious sites. Monitoring for and takedown of fraudulent domains by relevant authorities can help reduce exposure.
Description
Threat actors are exploiting anticipation for the FIFA World Cup 2026 through sophisticated phishing campaigns targeting fans seeking tickets, hospitality packages, and tournament information. Attackers have deployed FIFA-themed domains and mobile-optimized phishing infrastructure resolving to specific IP addresses, designed to harvest credentials and payment information. The campaigns feature convincing fake ticketing portals that mimic official FIFA services, collecting personal details including names, emails, phone numbers, and payment card data. Some variants redirect victims to online gambling platforms after credential theft. The infrastructure leverages third-party payment services like KOIpay and EBpay, with JavaScript redirecting users to external payment gateways. Victims face risks including fraudulent account creation, credential stuffing attacks, email account takeover, and unauthorized financial access. This operation represents part of a larger fraud ecosystem targeting the tournament.
Indicators of compromise
Domains 5
- fifa-ticket-26.com
- buy-ticket-fifa.com
- m.buy-ticket-fifa.com
- wap.buy-ticket-fifa.com
- www.buy-ticket-fifa.com