Threat reportPhishingTL-2026-1768
GHOST STADIUM Phishing Campaign Clones FIFA World Cup 2026 Ticket Sites to Steal Card Data and OTPs
GHOST STADIUM Phishing Campaign Clones FIFA World Cup 2026 (TL-2026-1768) is a high-severity phishing campaign, first published 2026-07-30. It is attributed to Ghost Stadium (China) with medium confidence, affects FIFA fifa.com Ticketing Portal Single Sign-On (PingIdentity-backed), maps to 25 MITRE ATT&CK techniques (T1005, T1036.005, T1041), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 1Ghost Stadium
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-1768
- Threat ID
- TL-2026-1768
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- Ghost Stadium
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- consumer, sports-entertainment, financial-services, retail-ecommerce
- Target regions
- Global, japan, North America, mexico, colombia
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in GHOST STADIUM Phishing Campaign Clones FIFA World Cup 2026
Malware and tooling: Lumma, Vidar, Layui
How GHOST STADIUM Phishing Campaign Clones FIFA World Cup 2026 works
Trend Micro tracked 35,538 malicious or suspicious FIFA/World-Cup-themed sites (Jan-Jun 2026, ~1.48M visits from Japan alone); within that wave, Group-IB independently identified a single cluster it calls GHOST STADIUM running one phishing kit across 300+ of 4,300+ registered domains, cloning fifa.com's real PingIdentity SSO (including the live production OAuth client_id) to capture credit-card data and OTPs in real time and push fraudulent charges through even with MFA enabled.
Between January and June 2026, Trend Micro's TrendAI telemetry flagged 35,538 malicious or suspicious websites containing the keywords "fifa" or "worldcup," drawing an estimated 1.48 million visits from Japan alone and likely far more globally. Within that broader wave of World Cup-themed counterfeit-merchandise shops, fake streaming portals, and fraudulent betting sites, a single cluster that Group-IB independently named GHOST STADIUM (public disclosure 2026-05-27) stands out for its technical sophistication and financial impact: a custom React single-page-application phishing kit, built on the Chinese open-source Layui 2.7.6 UI framework, deployed byte-for-byte identically across 300+ of more than 4,300 FIFA-themed domains registered since August 2025.
The kit reproduces fifa.com's real ticketing login flow to near pixel-perfect fidelity, including a functioning clone of FIFA's PingIdentity-backed single sign-on that embeds the genuine production OAuth client_id (35072598-fc20-4142-a469-1b940db47e6f) copied verbatim from the live service, complete with a "_p1:reset:userPassword_" scope parameter that lets the kit trigger password resets after credential capture. Victim-facing branding and product imagery are pulled live from FIFA's own CDN, defeating automated content-similarity phishing detectors that expect cloned assets to be locally hosted. After a victim submits card data and a one-time password, the kit's back end relays the transaction in real time - behaving as an adversary-in-the-middle that pushes the fraudulent charge through before the OTP expires, which is why multi-factor authentication does not stop the fraud - then silently redirects the browser to the real https://www.fifa.com/auth/ endpoint to delay victim suspicion.
Infrastructure analysis by Group-IB, independently corroborated by Validin, shows heavy automation: near-identical ~415 KB HTML payloads, 300+ domains sharing a small set of TLS certificate fingerprints and Meta Pixel tracking IDs, over half the cluster registered through a single registrar (GNAME.COM PTE. LTD.), and traffic driven primarily through Facebook ad campaigns using countdown-timer discount lures, with secondary funneling via Telegram/WhatsApp "Call now" buttons and organic search-engine-poisoning placement. A shared Tawk.to live-chat widget ID appears across the 79 domains focused on premium/hospitality tickets ($1,500-$10,000+ face value), where extrapolated victim counts alone could exceed 47,400 people and $71-474 million in losses; Group-IB estimates total losses across all GHOST STADIUM tiers could reach into the billions. Stolen funds are cashed out through diversified rails: direct card capture, a third-party payment gateway (pay.zfxupi.net), P2P apps (Chime cashtag $Paramjit-Bains, Nequi account 3202059757), a Mexico-specific rail (FIXYD), and the ChainUGO crypto on-ramp (testnet.chainugo.com), which converts stolen USD into USDT on Binance Smart Chain.
Chinese-language source-code comments, exclusive use of the Layui framework (virtually unknown outside Chinese developer circles), and locale handling that separately distinguishes Simplified, Traditional, and Hong Kong Chinese are the primary signals behind the "Chinese-speaking, financially motivated" attribution; there is no evidence of nation-state sponsorship, so this is tracked as a criminal actor rather than a state-backed one. Group-IB frames GHOST STADIUM as one of at least four independent threat actors and six distinct fraud schemes operating in the same World Cup 2026 fraud ecosystem - alongside a bulk domain-squatter, a phishing-kit-as-a-service supplier, and infostealer operators distributing Vidar and Lumma, whose logs have already surfaced roughly 170,000 FIFA-referencing infections and at least 2,513 FIFA account credential pairs for sale on dark-web markets at $5-$50 per pair. The campaign remains active through the tournament window (2026-06-11 to 2026-07-19) and beyond, with roughly 3,800 additional pre-registered domains parked and ready for activation.
MITRE ATT&CK techniques used in TL-2026-1768
Collection
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056.003 Web Portal Capture; T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Command and Control
T1071.001 Web Protocols; T1102 Web Service
command-and-control
T1090.002 External Proxy; T1102.002 Bidirectional Communication
Initial Access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service
Execution
Resource Development
T1583.001 Domains; T1583.004 Server; T1585.001 Social Media Accounts; T1588.002 Tool; T1608.001 Upload Malware; T1608.006 SEO Poisoning
Reconnaissance
T1593.002 Search Engines; T1594 Search Victim-Owned Websites
Impact
stealth
Affected products and versions in GHOST STADIUM Phishing Campaign Clones FIFA World Cup 2026
- FIFA — fifa.com Ticketing Portal Single Sign-On (PingIdentity-backed)
Remediation for GHOST STADIUM Phishing Campaign Clones FIFA World Cup 2026
Immediate actions
- Block identified GHOST STADIUM phishing domains and hosting IPs at web/email gateways, DNS resolvers, and CDN/WAF allow-deny lists
- Alert payment-fraud and AML teams to monitor for authorizations routed through pay.zfxupi.net, ChainUGO/testnet.chainugo.com, and the flagged Chime ($Paramjit-Bains) / Nequi (3202059757) cash-out identifiers
- Advise fans and staff to purchase FIFA World Cup 2026 tickets only via fifa.com or FIFA-authorized resellers, never via social-media ad links
- Report the shared Meta Pixel IDs and Facebook ad accounts to Meta for takedown given they link 300+ phishing domains to one advertiser
Workarounds
- Verify the browser address bar shows the genuine fifa.com domain before entering any payment or one-time-password data
- Treat unsolicited World Cup ticket ads offering steep discounts with countdown timers, or requiring cryptocurrency/P2P-app payment, as fraudulent
Longer-term hardening
- Deploy digital risk protection / brand-monitoring to detect newly registered FIFA-themed lookalike domains (via TLS-certificate, favicon-hash, and HTML-similarity pivots) before activation from the ~3,800 parked domains
- Implement phishing-resistant MFA (FIDO2/WebAuthn) for FIFA account and ticketing SSO to eliminate real-time OTP-relay bypass
- Continuously monitor infostealer-log marketplaces for leaked FIFA account credentials (Vidar/Lumma) and force credential resets
- Pursue coordinated registrar-level takedown with GNAME.COM PTE. LTD. given its concentration (57%) in the domain cluster, rather than one-off site takedowns
Timeline of GHOST STADIUM Phishing Campaign Clones FIFA World Cup 2026
- Dark-web phishing-kit sellers begin offering pre-built FIFA World Cup phishing kits (mid-2025, per Group-IB timeline), later adopted/customized into the GHOST STADIUM React/Layui kit.
- Bulk registration of FIFA-themed lookalike domains begins (since August 2025), eventually totaling 4,300+ domains tied to the broader fraud ecosystem GHOST STADIUM operates within.
- Trend Micro's TrendAI begins the tracking window (January-June 2026) that ultimately flags 35,538 malicious/suspicious FIFA- and World-Cup-themed sites.
- Four redirector domains (football-ticket.top, football-ticket.shop, football-game.shop, football-tickets.top) sharing origin IP 43.98.183.110 are registered to funnel traffic into the phishing cluster.
- Group-IB publicly discloses "The GHOST STADIUM Score," naming the actor/cluster, detailing the PingIdentity SSO clone, and estimating billions of dollars at risk.
- FIFA World Cup 2026 tournament window opens (through 2026-07-19), the expected peak-traffic period for the phishing and ticket-fraud cluster.
- Validin publishes an independent infrastructure-pivot analysis, identifying 3,079 active FIFA-lookalike domains and 6,113 suspected domains via HTML title, favicon-hash, and path pivots.
- Trend Micro's TrendAI tracking window closes having recorded roughly 1.48 million visits from Japan alone to flagged World-Cup-themed sites.
- FIFA World Cup 2026 tournament concludes; roughly 3,800 additional pre-registered GHOST STADIUM-linked domains remain parked and available for future activation.
- Trend Micro publishes "Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave," the source article that triggered this hunt.
Sources cited for GHOST STADIUM Phishing Campaign Clones FIFA World Cup 2026
- Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave
- The GHOST STADIUM Score: Billions At Stake At The World's Largest Football Tournament
- Offside and Online: GHOST STADIUM Phishing Targeting World Cup Fans
- GHOST STADIUM Phishing Campaign Targets FIFA World Cup Fans With 300+ Fake Domains
- 300+ Fake Domains Target FIFA Fans in GHOST STADIUM Scam, Infostealer Malware Threat Escalates
- FIFA World Cup 2026 scams are live: fake sites and malware
- Thousands of Fake FIFA Domains Target World Cup Fans
Detection coverage for TL-2026-1768
As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1768 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.