# GHOST STADIUM Phishing Campaign Clones FIFA World Cup 2026 Ticket Sites to Steal Card Data and OTPs

> Trend Micro tracked 35,538 malicious or suspicious FIFA/World-Cup-themed sites (Jan-Jun 2026, ~1.48M visits from Japan alone); within that wave, Group-IB independently identified a single cluster it calls GHOST STADIUM running one phishing kit across 300+ of 4,300+ registered domains, cloning fifa.com's real PingIdentity SSO (including the live production OAuth client_id) to capture credit-card data and OTPs in real time and push fraudulent charges through even with MFA enabled.

- **Published:** 2026-07-30T00:00:00Z
- **Last reviewed:** 2026-07-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1768
- **ID:** TL-2026-1768
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Ghost Stadium (China)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between January and June 2026, Trend Micro's TrendAI telemetry flagged 35,538 malicious or suspicious websites containing the keywords "fifa" or "worldcup," drawing an estimated 1.48 million visits from Japan alone and likely far more globally. Within that broader wave of World Cup-themed counterfeit-merchandise shops, fake streaming portals, and fraudulent betting sites, a single cluster that Group-IB independently named GHOST STADIUM (public disclosure 2026-05-27) stands out for its technical sophistication and financial impact: a custom React single-page-application phishing kit, built on the Chinese open-source Layui 2.7.6 UI framework, deployed byte-for-byte identically across 300+ of more than 4,300 FIFA-themed domains registered since August 2025.

The kit reproduces fifa.com's real ticketing login flow to near pixel-perfect fidelity, including a functioning clone of FIFA's PingIdentity-backed single sign-on that embeds the genuine production OAuth client_id (35072598-fc20-4142-a469-1b940db47e6f) copied verbatim from the live service, complete with a "_p1:reset:userPassword_" scope parameter that lets the kit trigger password resets after credential capture. Victim-facing branding and product imagery are pulled live from FIFA's own CDN, defeating automated content-similarity phishing detectors that expect cloned assets to be locally hosted. After a victim submits card data and a one-time password, the kit's back end relays the transaction in real time - behaving as an adversary-in-the-middle that pushes the fraudulent charge through before the OTP expires, which is why multi-factor authentication does not stop the fraud - then silently redirects the browser to the real https://www.fifa.com/auth/ endpoint to delay victim suspicion.

Infrastructure analysis by Group-IB, independently corroborated by Validin, shows heavy automation: near-identical ~415 KB HTML payloads, 300+ domains sharing a small set of TLS certificate fingerprints and Meta Pixel tracking IDs, over half the cluster registered through a single registrar (GNAME.COM PTE. LTD.), and traffic driven primarily through Facebook ad campaigns using countdown-timer discount lures, with secondary funneling via Telegram/WhatsApp "Call now" buttons and organic search-engine-poisoning placement. A shared Tawk.to live-chat widget ID appears across the 79 domains focused on premium/hospitality tickets ($1,500-$10,000+ face value), where extrapolated victim counts alone could exceed 47,400 people and $71-474 million in losses; Group-IB estimates total losses across all GHOST STADIUM tiers could reach into the billions. Stolen funds are cashed out through diversified rails: direct card capture, a third-party payment gateway (pay.zfxupi.net), P2P apps (Chime cashtag $Paramjit-Bains, Nequi account 3202059757), a Mexico-specific rail (FIXYD), and the ChainUGO crypto on-ramp (testnet.chainugo.com), which converts stolen USD into USDT on Binance Smart Chain.

Chinese-language source-code comments, exclusive use of the Layui framework (virtually unknown outside Chinese developer circles), and locale handling that separately distinguishes Simplified, Traditional, and Hong Kong Chinese are the primary signals behind the "Chinese-speaking, financially motivated" attribution; there is no evidence of nation-state sponsorship, so this is tracked as a criminal actor rather than a state-backed one. Group-IB frames GHOST STADIUM as one of at least four independent threat actors and six distinct fraud schemes operating in the same World Cup 2026 fraud ecosystem - alongside a bulk domain-squatter, a phishing-kit-as-a-service supplier, and infostealer operators distributing Vidar and Lumma, whose logs have already surfaced roughly 170,000 FIFA-referencing infections and at least 2,513 FIFA account credential pairs for sale on dark-web markets at $5-$50 per pair. The campaign remains active through the tournament window (2026-06-11 to 2026-07-19) and beyond, with roughly 3,800 additional pre-registered domains parked and ready for activation.

## MITRE ATT&CK

- T1593.002 Search Engines
- T1594 Search Victim-Owned Websites
- T1583.001 Domains
- T1583.004 Server
- T1585.001 Social Media Accounts
- T1608.001 Upload Malware
- T1588.002 Tool
- T1608.006 SEO Poisoning
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1036.005 Match Legitimate Resource Name or Location
- T1090.002 External Proxy
- T1684.001 Impersonation
- T1102.002 Bidirectional Communication
- T1056.003 Web Portal Capture
- T1111 Multi-Factor Authentication Interception
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1102 Web Service
- T1071.001 Web Protocols
- T1657 Financial Theft

## Sources

- [Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave](https://www.trendmicro.com/en/research/26/g/tracking-fake-sites-in-the-2026-world-cup-scam-wave.html)
- [The GHOST STADIUM Score: Billions At Stake At The World's Largest Football Tournament](https://www.group-ib.com/blog/ghost-stadium-football-fraud/)
- [Offside and Online: GHOST STADIUM Phishing Targeting World Cup Fans](https://www.validin.com/blog/ghost_stadium/)
- [GHOST STADIUM Phishing Campaign Targets FIFA World Cup Fans With 300+ Fake Domains](https://cybersecuritynews.com/ghost-stadium-phishing-campaign-targets-fifa-world-cup-fans/amp/)
- [300+ Fake Domains Target FIFA Fans in GHOST STADIUM Scam, Infostealer Malware Threat Escalates](https://the420.in/ghost-stadium-fifa-world-cup-2026-phishing-scam-fake-domains/)
- [FIFA World Cup 2026 scams are live: fake sites and malware](https://thenextweb.com/news/fifa-world-cup-2026-scams-phishing-malware)
- [Thousands of Fake FIFA Domains Target World Cup Fans](https://www.infosecurity-magazine.com/news/ghost-stadium-fifa-world-cup-fraud/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1768