The 2026 FIFA World Cup is not just a celebration of football. For cybercriminals, it is a business opportunity, and they have already gotten to work.

Threat actors have been building fake FIFA stores, spinning up phishing pages, and launching purchase scams at a scale that has security researchers watching closely.

The tournament, hosted across sixteen cities in the United States, Mexico, and Canada, draws billions of eyes worldwide. That global attention makes it one of the most attractive events for online fraud.

Criminals are exploiting that interest to steal payment card data, harvest personal information, and trick fans into paying for tickets or merchandise that will never arrive.

Analysts and researchers at Recorded Future said in a report shared with Cyber Security News (CSN) that cybercriminal exploitation of World Cup branding is already well underway.

Their Payment Fraud Intelligence team has tracked fake FIFA-branded stores, purchase scams, and spoofed FIFA and host-city domains, with fraudulent activity expected to intensify as the tournament progresses.

What makes this wave of fraud different from past World Cups is the role artificial intelligence now plays. Threat actors are using AI-generated content to produce phishing emails, smishing messages, and fake websites at a pace that no single security team can easily track.

The result is a fraud landscape that is faster, more convincing, and harder to contain than anything seen before the era of generative AI.

The threat does not stop at individual fans. Corporate sponsors, affiliated vendors, travel providers, and ticketing platforms are all in the crosshairs.

Stolen payment credentials are being used by carders to buy real tickets, which are then resold for profit. This kind of fraud lets criminals move money quickly while hiding behind the appearance of a normal transaction.

Cybercriminals Exploit 2026 FIFA World Cup

In one campaign active during April and May 2026, Recorded Future’s Payment Fraud Intelligence team identified a network of 33 World Cup-themed purchase scam domains connected to roughly 2,500 online advertisements.

These fake stores were built to look like official FIFA merchandise outlets, attracting victims through ads on platforms like Meta. When a victim made a purchase, the order never arrived, but their payment card data and personal information were fully exposed.

Composite Country Risk Scores for Canada, Mexico, and the US (Source - Recorded Future) — Composite Country Risk Scores for Canada, Mexico, and the US (Source – Recorded Future)

Several of those scam domains used multiple merchant accounts to keep payments flowing even as individual domains were rotated out.

This allows criminals to keep their payment infrastructure running behind the scenes, even when one storefront gets taken down. It is a level of sophistication that makes these scams harder to stop than a simple one-off fake website.

The scam domain onlinefifavip-eu[.]shop promoted through Meta Ads Library (Source - Recorded Future) — The scam domain onlinefifavip-eu[.]shop promoted through Meta Ads Library (Source – Recorded Future)

In a second campaign, threat actors compromised legitimate websites and manipulated how those pages appeared in search results. Victims searching for official FIFA merchandise would land on what looked like a trusted site, only to be quietly redirected to a scam domain.

Search engine results for superbclicks[.]com redirecting victims to purchase scam domain jpopfreehhh[.]click (Source - Recorded Future) — Search engine results for superbclicks[.]com redirecting victims to purchase scam domain jpopfreehhh[.]click (Source – Recorded Future)

The scam pages did not even need to appear in search results, because the traffic came through already-indexed pages.

Phishing, Dark Web Activity, and Stolen Credentials

Since April 1, 2026, Insikt Group researchers detected more than 1,100 suspicious domains containing the words “World” and “Cup,” over 600 typosquat domains mimicking fifa.com, and 260 registered domains combining FIFA branding with host-city names.

The scam domain fifafanstorehub[.]com promoted through Meta Ads Library (Source - Recorded Future) — The scam domain fifafanstorehub[.]com promoted through Meta Ads Library (Source – Recorded Future)

Chinese-speaking threat actors have reportedly cloned FIFA’s official website across around 300 domains to harvest user credentials ahead of the tournament.

On the dark web, stolen FIFA-related credentials linked to individual accounts are already being sold on marketplaces like Russian Market.

Threat actors have also been spotted advertising cash-out services on criminal forums, targeting major ticketing platforms including Ticketmaster, StubHub, and SeatGeek. These services let criminals convert stolen payment data or account access into real money fast.

Threat actor advertising cash-out services for event payments on major ticketing platforms, including Ticketmaster, StubHub, SeatGeek, and Vivid Seats (Source - Recorded Future) — Threat actor advertising cash-out services for event payments on major ticketing platforms, including Ticketmaster, StubHub, SeatGeek, and Vivid Seats (Source – Recorded Future)

Security experts recommend that fans avoid clicking links in unsolicited emails or texts about World Cup tickets and always verify any store or ticket source through official FIFA channels.

Organizations connected to the tournament should monitor for brand abuse, newly registered lookalike domains, and compromised credentials appearing on dark web forums. Proactive credential monitoring and domain alerting are among the strongest defenses available right now.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Domain	onlinefifavip-eu[.]shop	FIFA World Cup purchase scam domain promoted via Meta Ads Library
Domain	superbclicks[.]com	Compromised legitimate website used to redirect victims to scam infrastructure
Domain	jpopfreehhh[.]click	Purchase scam domain receiving redirected victims from superbclicks[.]com
Domain	fifafanstorehub[.]com	FIFA-branded fake store used in mobile wallet fraud attack chain, promoted via Meta Ads

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Cybercriminals Exploit 2026 FIFA World Cup With Phishing, Fake Stores, and Ticket Scams appeared first on Cyber Security News.