FIFA World Cup 2026 Fraud Followed Qatar 2022’s Playbook Into Offices

FIFA World Cup 2026 ended Sunday in the United States, but the scam infrastructure it inspired is still running. Cybersecurity firm Group-IB counted more than 4,300 fake FIFA websites registered since August 2025, most built to catch fans hunting for tickets and streams. Malaysian data security firm SearchInform says the real damage is landing somewhere else: inside corporate networks, through employees who used office laptops to watch matches, join betting pools or chase fake giveaways.

The same scam economy targeted Qatar in 2022. What changed by 2026 is the machinery behind it, and the fact that a password stolen from a fan’s phone now travels straight into a company’s servers.

A Bigger Stadium for Fraud

Group-IB’s research identified six distinct fraud schemes and four independent threat actor groups riding on the tournament’s back. At the center sits GHOST STADIUM, a Chinese-speaking, financially motivated operation running a custom phishing kit across more than 300 domains. The kit clones fifa.com down to the pixel, complete with a fake single sign-on login and support in 11 languages, according to Group-IB’s investigation into the campaign.

Premium and hospitality ticket fraud alone could account for losses reaching between $71 million and $474 million, Group-IB estimated, with the full campaign, including credential theft and lower-tier ticket scams, potentially running into the billions. Separately, threat research unit FortiGuard Labs tallied more than 13,000 World Cup-themed domains registered between January and May 2026 alone, about 8.8% of them flagged malicious or suspicious.

The FBI opened its own file on the problem months before kickoff. Its Internet Crime Complaint Center published a running list of confirmed FIFA lookalike domains, warning that typo squatted addresses like fake job pages and misspelled logins would keep multiplying through the tournament.

Qatar Wrote This Playbook in 2022

This is not a first draft. Group-IB ran the same kind of investigation ahead of Qatar 2022 and came away with an even larger raw domain count, more than 16,000 scam sites, plus dozens of fake social media accounts and mobile apps, all shared with INTERPOL at the time.

That earlier campaign also reached inside an official system. Researchers found roughly 90 compromised accounts on Hayya, Qatar’s mandatory fan portal, with passwords lifted using RedLine and Erbium, two commodity infostealer programs sold cheaply on criminal forums, per Group-IB’s Qatar 2022 threat findings.

Employees were already a target back then, not just fans. Security firm KnowBe4 tracked a surge in phishing aimed squarely at World Cup organizing staff, driven mostly by five known criminal gangs. Jake Moore, global cybersecurity advisor at ESET, said at the time that major events attract scammers because timed phishing emails get taken more seriously by tired, distracted recipients. Trellix separately measured phishing attempts across the Middle East doubling in the two months before kickoff.

The raw domain counts moved in different directions between the two tournaments, which is worth being honest about. What has clearly escalated is the sophistication and reuse of the tooling. Threat intelligence firm CybelAngel found the fraud volume around the 2026 tournament reflects an industry that can now spin up cloned domains and fabricated identities within minutes rather than days, a shift the firm ties directly to AI adoption since 2023.

Read side by side, the pattern looks less like a single unprecedented event and more like a recurring cost of doing business around global sport, one that keeps finding new doors into the same buildings.

From the Ticket Line to the Cubicle

Francis Yeoh, SearchInform’s Malaysia country director, said the biggest threat this year did not come from outside the firewall. It came from employees logging into unofficial streams, entering fraudulent giveaways or joining office betting pools on company hardware.

During major global events, the corporate security perimeter is under huge stress. Traditional network-edge security is insufficient as the real danger comes from the employee side of the fence.

Yeoh’s warning lines up with what researchers found in the wild. Fraudsters built fake streaming platforms and Android apps capable of harvesting saved passwords and browser credentials, then wrapped phishing emails around match promotions, gift offers and workplace competitions to get people to click. Kaspersky and ThreatFabric separately tied a wave of unofficial streaming apps, many posing as the piracy site RojaDirecta, to Android banking trojans named Massiv and Perseus, designed to drain money straight out of banking and crypto apps once installed.

The Cost of a Reused Password

The mechanism connecting a fan’s stream to a company breach is almost always the same tired habit: password reuse. A 2026 password behavior study found that more than half of employees reuse passwords across multiple work accounts, and a similar share admit to reusing the same or a nearly identical password between personal and work logins.

• 54% of employees reuse passwords across multiple work accounts, according to a 2026 password behavior survey.
• 44% of people use the same or a similar password for both personal and work logins.
• Verizon’s 2025 Data Breach Investigations Report found compromised credentials were the opening move in 22% of breaches, and turned up in infostealer logs pulled from 30% of corporate managed devices and 46% of unmanaged ones.

That last figure is the one that should worry a chief information security officer watching World Cup traffic logs. An employee’s personal password, entered on a fake streaming site or a knockoff betting app, does not need to be a work password to become one. If it is close enough, or identical, an infostealer log built for fraud becomes a corporate breach.

What Should Companies Do Before the Next Tournament?

Yeoh’s advice for employers is not exotic, but it is specific. Companies should treat major global events as a recurring, predictable spike in risk rather than a one-off surprise.

• Restrict personal activity on corporate devices, particularly unofficial streaming, suspicious downloads and unverified websites.
• Watch for reused passwords, since credentials exposed through personal services can open a path straight into corporate accounts.
• Enforce multi-factor authentication, especially for privileged and remote employees.
• Monitor who accesses sensitive data, from where and how it moves, and extend that oversight to cloud platforms rather than office servers alone.

The same caution applies to job hunting, which fraudsters have learned to exploit just as effectively as ticket sales. CybelAngel’s tracking of task scams and fake recruitment portals found the same phishing kit reused across other major brands entirely, which means the risk does not disappear once the World Cup does. For employees, Yeoh’s message is direct: watch matches through legitimate services, skip unofficial apps, and never enter work credentials into a streaming account, a betting site or a promotional form.

Football’s Data Problem Reaches Beyond the Fans

Fan scams and employee slip ups were not the only track this year. In April, a hacker claiming ties to the ShinyHunters extortion collective posted 150,000 exposed player and coaching profiles tied to the Asian Football Confederation and Saudi club Al Nassr FC, a separate breach that landed just weeks before the tournament kicked off.

Football’s institutions, its fans, and now its corporate onlookers are all being hit by the same broad appetite for anything wearing the World Cup name. In 2022, Trellix’s head of threat intelligence, John Fokker, told researchers his team expected the post tournament phishing wave to keep running for weeks after Qatar’s final whistle. Group-IB says roughly 3,800 fraudulent FIFA domains from this year’s campaign are still sitting parked and dormant, registered but unused, ready to be switched on whenever the next opportunity arrives.

Frequently Asked Questions

Which countries did the World Cup 2026 scam campaigns target?

Security firm Bitdefender tracked fraudulent activity built around the World Cup brand starting in February 2026 across the United Kingdom, Portugal, Spain, Algeria, the United States, Canada, Mexico, Brazil, Germany and Australia, using fake merchandise, kits, streaming offers and collectible sticker scams well outside the three host nations.

Can multi-factor authentication stop credential theft from these scams?

Not entirely. Threat intelligence researchers have found that malware built to harvest passwords increasingly captures active session cookies alongside the credentials themselves, a technique that can let an attacker slip past multi-factor authentication because the stolen session already looks logged in.

Did scammers build fake World Cup betting platforms too?

Yes. CybelAngel identified a cluster of Telegram channels posing as an official FIFA World Cup betting platform, complete with a bot handling deposits and withdrawals and a companion Android app called 2026 Sports that reported back to a hidden control server. Victims who deposited funds found withdrawals never arrived.

Were FIFA job seekers targeted by these scams?

Yes. CybelAngel documented cloned FIFA recruitment portals, and in at least one case the scam used the real name and photograph of an actual FIFA recruitment manager, who later confirmed their identity had been misused without consent.

How long do passwords stolen during the tournament stay dangerous?

Often for months. Identity researchers at Constella Intelligence found that nearly 60% of breach datasets they ingested in 2026 were recycled credential compilations, meaning stolen logins from events like the World Cup keep circulating and getting reused in fresh attacks long after the news cycle moves on.