A major phishing operation is targeting soccer/football fans ahead of the 2026 FIFA World Cup, which begins in June, according to researchers at Flare. The attackers have set up at least 79 phishing sites impersonating the official FIFA website.
“The fraudulent sites function as full-ecosystem replicas, not simple phishing pages: HTML and structural elements are copied from the malicious infrastructure, while images and icons are pulled directly from the real FIFA website, blending legitimate and fraudulent content to deceive even attentive users,” Flare says.
The attackers have registered typosquatting and lookalike domains designed to fool users into thinking they’re on the legitimate FIFA site.
“Threat actors have registered domains such as vww-fifa[.]com, which combines character substitution (“www” → “vww”) and structural variation (“fifa.com” → “fifa-com”) to mislead even experienced users,” the researchers explain. “Lookalike domains, by contrast, do not rely on direct string similarity but instead exploit brand association and user expectations. Domains such as fifa[.]sale can convincingly impersonate official services – such as ticketing or merchandise platforms—despite not matching the original domain structure.”
The sites are designed to trick users into entering their credentials and payment information, as well as send a direct payment to the attackers when the user tries to purchase phony tickets or merch. Additionally, if the attackers obtain credentials for a user’s legitimate FIFA account, they may be able to steal their real tickets and scalp them for exorbitant prices.
Flare concludes, “Awareness, verification, and proactive monitoring are critical for fans, and organizations can proactively detect and disrupt fraud infrastructure to protect end users.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce human risk.
Flare has the story: Massive World Cup Consumer Fraud Infrastructure Targets Fans Before Kickoff
