# Winter Olympics 2026 Domain Impersonation and Phishing Infrastructure Campaign

> BforeAI PreCrime Labs, corroborated by Malwarebytes, ZeroFox, WEF, SecureWorld, and ESET research, documents a large-scale opportunistic brand-abuse ecosystem exploiting the Milano Cortina 2026 Winter Olympics: over 1,600 impersonating domains, credential-harvesting 'OlympicGPT' phishing portals, counterfeit merchandise storefronts promoted via Meta ad fraud, ticketing/accommodation scams, a WhatsApp smishing campaign built on a compromised hotel booking system, and CDN-abused (Cloudflare Pages) staging infrastructure for traffic distribution and malware/pop-up delivery.

- **Published:** 2026-03-31T00:00:00Z
- **Last reviewed:** 2026-03-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1523
- **ID:** TL-2026-1523
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since September 2025, threat actors have registered and operated a sprawling network of Olympics-themed domains — BforeAI's PreCrime Labs catalogued 1,623 suspicious domains — timed to the Milano Cortina 2026 Winter Games' marketing cadence (peak registration December 2025–February 2026) and pre-positioned ahead of the LA 2028 and future 2030/2032 Games. The campaign spans multiple monetization tracks run by financially motivated, opportunistic actors rather than a single named group: (1) counterfeit merchandise storefronts (42 domains containing 'shop', 36 containing 'store') cloned with polished, near-identical templates advertising official items at 50-80% discounts, promoted through deceptive Meta/Facebook ad campaigns and newly created Facebook pages that rotate quickly to evade takedown, harvesting payment-card data, names, addresses, and phone numbers at checkout; (2) ticketing fraud (10+ domains using 'ticket' keywords) impersonating official vendors; (3) accommodation/travel fraud, including luxury-rental domains targeting both Milano Cortina 2026 and LA 2028 travelers; (4) 'OlympicGPT' credential-harvesting login portals that combine Olympic imagery with AI-assistant branding to lure victims into submitting email credentials; (5) a documented WhatsApp smishing operation in which attackers — leveraging a compromised Milan hotel reservation system — sent victims accurate booking confirmation IDs alongside malicious links under 24-hour deadline pressure; (6) malware and malicious-redirect distribution via exotic TLDs (.xyz, .shop, .top) serving pop-ups and drive-by redirect chains; and (7) gambling/cryptocurrency-themed lookalikes (e.g., olympiccasinoonline[.]sk). Infrastructure is deliberately built for resilience and legitimacy: actors abuse reputable CDNs, specifically Cloudflare Pages (winter-olympics-schedule[.]pages[.]dev) and Cloudflare's proxy/CDN network (fronting IP 104.18.19.207, tied to a Milano Cortina fake-retail domain cluster), and invoke external JavaScript from randomized, hash-like directory paths on separate domains — consistent with a traffic-distribution-system (TDS) architecture used to gate victims into region- or device-specific scam funnels. Domains were registered across a wide spread of registrars (GoDaddy, Namecheap, Porkbun, Squarespace Domains, Hostinger) as well as abuse-associated registrars (DropCatch, NameMart) and generic top-level domains (.top, .shop, .store, .com, .us.com), with typosquat variants using character substitution (e.g., zero-for-o: winter0lympicsstore[.]top) and extra hyphenation. Malwarebytes independently tracked ~20 fake storefronts and observed victim telemetry from Ireland, the Czech Republic, the United States, Italy, and China. ZeroFox and WEF/SecureWorld reporting broadens the threat picture beyond opportunistic fraud to include exposed/reused Olympic-infrastructure credentials and session tokens enabling account takeover and lateral movement, infostealer and botnet credential/cookie harvesting feeding criminal marketplaces for later weaponization, and AI-assisted phishing plus malicious mobile applications posing as official Olympic tools. No specific CVE, malware family, or nation-state attribution is confirmed in the source reporting; this is tracked as an active, scalable brand-abuse and phishing ecosystem rather than a single intrusion, with elevated concern given the Games' global visibility (3+ billion expected viewers) and the parallel presence of nation-state and hacktivist interest noted by WEF/SecureWorld and other event-security reporting.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1593 Search Open Websites/Domains
- T1583.001 Domains
- T1583.006 Web Services
- T1587.001 Malware
- T1585.001 Social Media Accounts
- T1584.004 Server
- T1588.001 Malware
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1078 Valid Accounts
- T1036 Masquerading
- T1684.001 Impersonation
- T1090.003 Multi-hop Proxy
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1005 Data from Local System
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1090.004 Domain Fronting
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Cyber Threat Trends During the Winter Olympics 2026](https://bfore.ai/report/cyber-threat-trends-winter-olympics-2026/)
- [Fake shops target Winter Olympics 2026 fans](https://www.malwarebytes.com/blog/scams/2026/02/fake-shops-target-winter-olympics-2026-fans)
- [A slippery slope: Beware of Winter Olympics scams and other cyberthreats](https://www.welivesecurity.com/en/cybersecurity/slippery-slope-winter-olympics-scams-cyberthreats/)
- [Cyber Threats to the Milan 2026 Winter Olympics Organizations Need to Know](https://www.zerofox.com/blog/cyber-threats-milan-2026-winter-olympics/)
- [The Milan-Cortina 2026 Games are a prime cyber target. Here's why](https://www.weforum.org/stories/2026/02/2026-milan-cortina-olympic-games-cyber-target-how-defenders-responding/)
- [Cyber Threats to the Milano Cortina 2026 Winter Olympics](https://www.secureworld.io/industry-news/cyber-threats-milano-cortina-2026-winter-olympics)
- [Fake Winter Olympics 2026 Stores Target Fans With Data-Theft Scams](https://www.esecurityplanet.com/threats/fake-winter-olympics-2026-stores-target-fans-with-data-theft-scams/)
- [Defending the 2026 Milano-Cortina Winter Games](https://www.paloaltonetworks.com/resources/research/unit-42-cyber-vigilance-program/2026-winter-games-milano-cortina)
- [Olympics: Fake Milano Cortina sites target thousands with discount scams, cybersecurity firm says](https://arizonadigitalfreepress.com/olympics-fake-milano-cortina-sites-target-thousands-with-discount-scams-cybersecurity-firm-says/)
- [Securing Gold in Cyber Defense at the Milano Cortina Games](https://sites.suffolk.edu/jhtl/2026/04/11/securing-gold-in-cyber-defense-at-the-milano-cortina-games/)
- [BforeAI Highlights Cyber Threat Trends Around 2026 Winter Olympics](https://www.tipranks.com/news/private-companies/bforeai-highlights-cyber-threat-trends-around-2026-winter-olympics)
- [2026 Winter Olympics Cyber Security Means Defending Trust at Event Scale](https://www.penligent.ai/hackinglabs/2026-winter-olympics-cyber-security-means-defending-trust-at-event-scale/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1523