# FIFA World Cup 2026 Fraud Ecosystem: GHOST STADIUM Phishing, Mass Typosquatting, and Vidar/Lumma Infostealer Credential Theft

> A sprawling, multi-actor fraud ecosystem is exploiting the 2026 FIFA World Cup: 4,300+ lookalike/typosquat domains (SOCRadar counts 1,100+ 'World Cup' domains and 600+ FIFA typosquats; Group-IB's GHOST STADIUM tracking shows 300+ live phishing domains and 3,800+ parked since August 2025), a Chinese-speaking operator's pixel-perfect PingIdentity-SSO-cloning phishing kit, and Vidar/Lumma-dominated infostealer pipelines feeding 130,000+ dark-web credential logs (2,500+ confirmed FIFA account pairs). The FBI IC3 issued PSA I-052726-PSA on 2026-05-27 naming 43 fraudulent FIFA-spoofing domains.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1573
- **ID:** TL-2026-1573
- **Severity:** HIGH
- **Category:** FRAUD
- **Status:** ACTIVE
- **Actor:** Ghost Stadium
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Multiple independent research teams (SOCRadar, Group-IB, Cyble, Flare, Rescana, the FBI's IC3) have converged on the same finding: the 2026 FIFA World Cup has produced an unprecedented, professionalized cybercrime ecosystem spanning six parallel fraud schemes operated by at least four distinct threat clusters. The most developed cluster, tracked by Group-IB as GHOST STADIUM, is attributed with medium-high confidence to a Chinese-speaking, financially motivated operator based on Chinese-language source code comments, use of the Layui 2.7.6 Chinese open-source UI framework, and locale auto-detection covering Simplified, Traditional, and Hong Kong Chinese alongside 8+ other languages. GHOST STADIUM has registered 4,300+ domains since August 2025 (300+ live, 3,800+ parked/pre-positioned for activation near kickoff), sharing infrastructure fingerprints across the cluster: identical Tawk.to live-chat property ID, three shared Meta Pixel advertising IDs, shared SSL certificates, and 14 hosting IP nodes. The flagship phishing kit is a custom React single-page application that pixel-perfect clones fifa.com, including a functional clone of FIFA's real PingIdentity SSO login flow (reusing FIFA's actual client_id) and a password-reset function that locks victims out post-capture and redirects them to the legitimate FIFA site to reduce suspicion. Six fraud schemes run in parallel: (1) SSO credential phishing, (2) fake premium/hospitality ticket sales estimated at $71-474M in losses alone, (3) counterfeit merchandise storefronts (56+ domains) with Telegram sales channels, (4) fraudulent streaming platforms (55+ domains), (5) fake betting/casino sites (32+ domains), and (6) infostealer-driven mass credential theft. Payment monetization spans direct card capture, third-party payment gateways (pay.zfxupi.net), peer-to-peer cashout (Chime, Nequi), Mexico-specific payment rails (FIXYD), and crypto on-ramps (Alchemy Pay to USDT via Binance Smart Chain), indicating a mature, well-funded money-laundering operation. Separately, Flare Systems documents an infostealer supply chain feeding this credential-theft economy: victims searching for pirated/cracked software (e.g., free PDF editors) are funneled through disposable .cfd redirector domains to fake Google Drive download pages serving a ZIP that DLL-sideloads a trojanized SDL3.dll into a renamed, legitimate Steam binary (HijackLoader/Rugmi), ultimately deploying Lumma Stealer via reflective, largely fileless in-memory execution with a second stage steganographically hidden inside PNG IDAT chunks. Across April 2025-April 2026, Flare identified nearly 130,000 infostealer logs referencing FIFA-related credentials (Vidar 67%, Lumma 24%, StealC 5%, RedLine 3%, Nexus/Aurora 1% each), with 2,500+ confirmed exposed email/password pairs split across fifa.com and fifa.org. Compromised staff, partner, or vendor credentials create a pivot path into FIFA's operational/ticketing backend and SSO infrastructure. The FBI's Internet Crime Complaint Center corroborated the domain-spoofing threat independently, issuing PSA I-052726-PSA on 2026-05-27 (alert number I-052726-PSA) naming 43 fraudulent domains using typosquatting (fiffa.com), alternative TLDs (fifa.cab, fifa.pink, fifa.blue, fifa.pub, fifa.beer, fifa.click), and subdomain impersonation (jobs-fifa.com, fifa-hr.com, fifa-hiring.com) for credential harvesting and counterfeit ticket sales. Given the ~150 million ticket requests logged in the first 14 days of the sales window, the operation exploits acute urgency and scarcity to drive victims past normal diligence.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1593 Search Open Websites/Domains
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1598 Phishing for Information
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [2026 FIFA World Cup Threat Landscape: The Kickoff for Cybercriminals](https://socradar.io/blog/2026-fifa-world-cup-threat-landscape/)
- [Internet Crime Complaint Center (IC3) PSA260527 — Threat Actors Spoofing FIFA Websites in Advance of the 2026 World Cup](https://www.ic3.gov/PSA/2026/PSA260527)
- [FIFA World Cup 2026 Scams Surge As Fake Sites Target Fans](https://cyble.com/blog/fifa-world-cup-2026-scams/)
- [Active Exploitation Alert: FIFA World Cup 2026 Targeted by Fake Ticket Sites, Banking Malware, and Credential Theft](https://www.rescana.com/post/active-exploitation-alert-fifa-world-cup-2026-targeted-by-fake-ticket-sites-banking-malware-and-credential-theft)
- [2026 FIFA World Cup Digital Platforms Face Surge in Sophisticated Cyber Threats and Fraud](https://www.rescana.com/post/2026-fifa-world-cup-digital-platforms-face-surge-in-sophisticated-cyber-threats-and-fraud)
- [From Pirated Software to Full Access to FIFA: Tracing the 2026 World Cup Infostealer Pipeline](https://flare.io/learn/resources/blog/2026-world-cup-infostealer-pipeline)
- [GHOST STADIUM Phishing Campaign Targets FIFA World Cup Fans With 300+ Fake Domains](https://cybersecuritynews.com/ghost-stadium-phishing-campaign-targets-fifa-world-cup-fans/amp/)
- [The GHOST STADIUM Score: Billions At Stake At The World's Largest Football Tournament](https://www.group-ib.com/blog/ghost-stadium-football-fraud/)
- [Thousands of Fake FIFA Domains Target World Cup Fans](https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/)
- [FBI warns World Cup fans over fake FIFA sites](https://cybernews.com/cybercrime/fbi-world-cup-fifa-ticket-scam-warning/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1573