FIFA World Cup 2026: Cybercriminals Are Already Launching Attacks

FortiGuard Labs research shows how threat actors are using tournament demand to launch scams and steal credentials

As the FIFA World Cup 2026 kicks off on June 11, billions of fans worldwide will tune in to celebrate football’s biggest spectacle. But alongside the excitement comes another competition—one being waged by cybercriminals.

According to new research from FortiGuard Labs, threat actors have already begun exploiting the tournament months before kickoff, launching phishing campaigns, fake ticketing platforms, malicious apps, and social engineering scams designed to target fans, businesses, sponsors, and event partners.

Major global sporting events generate massive online traffic, emotional engagement, and billions of dollars in digital transactions. Fans search for tickets, travel packages, livestreams, betting platforms, merchandise, and tournament updates, while organizations coordinate logistics, hospitality, staffing, media operations, and customer service. For cybercriminals, this surge in online activity creates the perfect opportunity to strike.

Cybercriminal Infrastructure Already in Place

FortiGuard Labs found that between January and May 2026, more than 13,000 FIFA World Cup-themed domains were registered. Alarmingly, approximately 8.8% of these domains have already been identified as malicious or suspicious based on scam activity and behavioral analysis.

The findings show that cybercriminals are not waiting for the opening whistle—they have already built an extensive infrastructure designed to exploit the global event.

Fake Websites Fuel a Growing Wave of Scams

Researchers observed a sharp rise in FIFA-themed domain registrations from March through May, with many websites abusing FIFA branding while promoting ticket sales, livestreams, betting services, travel packages, and hospitality offers.

Many of these fraudulent websites closely imitate legitimate FIFA pages, making them convincing enough to deceive users during quick online searches.

FortiGuard Labs identified a wide range of World Cup-related cyber threats, including:

• Phishing campaigns and fake ticketing websites
• Ticket resale scams promoted through Telegram and messaging platforms
• Counterfeit merchandise stores
• Malicious betting and livestreaming applications
• Third-party Android APK downloads carrying malware
• Fake FIFA-related social media accounts
• Fraudulent job recruitment campaigns
• Cryptocurrency scams and fake token airdrops
• Credential exposure linked to infostealer malware and historical data breaches

The report highlights how cybercriminals are building an interconnected ecosystem of scams that spans multiple platforms, attack methods, and victim profiles.

Ticket Scams Continue to Target Passionate Fans

Among the most dangerous threats are fake ticketing websites.

Limited ticket availability often drives fans toward resale marketplaces, social media groups, Telegram channels, and search advertisements. Cybercriminals exploit that urgency by advertising fake “limited-time” offers that pressure victims into making immediate purchases.

FortiGuard Labs discovered numerous counterfeit ticketing portals that closely mimic official FIFA websites. Some fake checkout pages were specifically designed to steal personal information, login credentials, billing details, and payment information.

Researchers also uncovered scam campaigns offering bundled packages that combined fake match tickets with counterfeit flights and hotel accommodations, making fraudulent offers appear more legitimate.

These scams succeed because they prey on emotion and urgency—fans focused on securing a ticket are less likely to recognize subtle warning signs.

Social Media Has Become a Major Attack Channel

The research also identified more than 1,700 suspected FIFA-related impersonation accounts across social media and messaging platforms, with nearly 90% appearing on Facebook and Instagram.

These fake accounts are used to spread fraudulent promotions, phishing links, fake livestreams, malware, misinformation, and ticket scams while blending into legitimate fan conversations.

Whether it’s a fake ticket seller in a supporter group or a livestream link shared moments before kickoff, attackers rely on convincing branding and perfect timing to lure unsuspecting users.

Malicious Apps Add Another Layer of Risk

FortiGuard Labs also detected malware disguised as World Cup-related applications.

One executable named “1xbet.exe” displayed characteristics associated with persistence mechanisms, encrypted communications, and potential ransomware activity. Researchers also discovered suspicious FIFA-themed Android APK files distributed through unofficial download sites.

As fans look for betting apps, score trackers, livestreaming platforms, and promotional tools, cybercriminals are taking advantage by distributing trojanized software capable of installing spyware, stealing credentials, or providing remote access to infected devices.

The report emphasizes that downloading applications from unofficial sources dramatically increases the risk of compromise.

Fake Job Offers Target Job Seekers

The FIFA World Cup creates thousands of temporary employment opportunities across hospitality, logistics, transportation, media, and event management. Cybercriminals are exploiting that demand as well.

FortiGuard Labs uncovered phishing campaigns using fake FIFA-related job advertisements and sponsor recruitment posts.

Victims received calendar invitations directing them to counterfeit Google login pages. Once credentials were entered, users were shown generic error messages while attackers silently harvested their account information.

Researchers also discovered multiple fraudulent domains impersonating FIFA and partner organizations that shared the same Google Analytics tracking ID, suggesting a coordinated cybercrime operation leveraging legitimate cloud infrastructure to disguise malicious activity.

Stolen Credentials Increase Long-Term Risk

The report also uncovered significant credential exposure linked to FIFA-related activity.

FortiGuard Labs identified more than 4,600 FIFA-related URLs appearing in infostealer malware logs associated with malware families including Vidar, LummaC2, and RedLine.

Researchers also found:

• More than 260 FIFA employee credentials
• Over 270,000 credentials belonging to users who accessed FIFA-related websites
• More than 1,500 FIFA-related employee and organizational accounts exposed in historical breach datasets

While not every exposed credential remains active, attackers frequently combine older breach data with fresh phishing campaigns to carry out credential stuffing, account takeovers, identity impersonation, and financial fraud.

Preparing Before the Tournament Begins

FortiGuard Labs warns that cyber threats surrounding major sporting events begin long before the opening match.

Organizations across sports, travel, hospitality, retail, finance, transportation, government, media, and critical infrastructure should proactively monitor for lookalike domains, brand impersonation, fake advertisements, fraudulent social media accounts, and credential leaks involving employees, customers, and business partners.

At the same time, fans should protect themselves by purchasing tickets only through official channels, avoiding third-party APK downloads, verifying livestream sources, confirming job opportunities through legitimate websites, and treating urgent payment requests with caution.

The key message from FortiGuard Labs is clear: cybercriminals move as quickly as global attention shifts. With the FIFA World Cup 2026 already capturing worldwide interest, attackers have wasted no time building the infrastructure to exploit it. Organizations and fans alike should prepare now—before the first match even begins.