AI-driven phishing and fraud target 2026 FIFA World Cup fans
Cybercriminals deployed thousands of fake ticket portals, merchandise stores, and streaming sites targeting 2026 FIFA World Cup fans across multiple countries. AI-powered phishing campaigns and sophisticated payment interception operations reportedly stole fan credentials and financial data, with exposure estimated to reach millions of dollars.
What happened
Cybercriminals created thousands of fake ticket portals, merchandise stores, streaming sites, and betting apps targeting FIFA World Cup fans. Fortinet identified more than 13,000 FIFA-related web domains created since January 2026, of which 8.8% (about 1,150) were malicious, and more than 1,700 new impersonation accounts on social media, predominantly on Facebook and Instagram.
CloudSEK identified a sophisticated Chinese threat operation targeting fans across more than 13 geographies by intercepting payment details and SMS-based authentication. The fake platform could track victims' checkout journeys, capture payment card details including PAN, expiry and CVV, and potentially relay one-time passwords in real time.
AI enabled more personalized and convincing phishing campaigns. Check Point Software Technologies documented a fourfold increase in domain registrations containing 'FIFA' or 'Copa Mundial' between February and April 2026, reaching 9,741 new domains in April alone, representing more than five times the peak during the 2022 FIFA World Cup in Qatar.
Reported impact
Fraud exposure during the tournament lifecycle can easily reach millions of dollars according to Fortinet. More than 260 FIFA employee credentials and over 270,000 credentials of users visiting FIFA-related websites were available on the dark web.
Index analysis
The scams exploited characteristics of the FIFA World Cup event: massive global attention, emotional urgency, high ticket demand, travel pressure, merchandise buying, streaming demand, betting activity, and job-seeking around the event. Fraudsters used social media and messaging channels like WhatsApp, Telegram, and Discord as primary malware delivery channels, dropping fake streaming links minutes before matches.
Governance controls
Cybersecurity firms including Fortinet, CloudSEK, Arctic Wolf, and Check Point Software Technologies identified and documented the fraudulent infrastructure and threat operations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.