Ahead of the FIFA World Cup 2026 kickoff on June 11, a large-scale fraud ecosystem is already operational. Over 4,300 fake FIFA domains have been registered, with one operation (Ghost Stadium) running 300+ cloned FIFA login pages to steal credentials and resell tickets. FortiGuard Labs counted 13,000+ World Cup-themed domains, with ~8.8% flagged as malicious. Android banking trojans Massiv and Perseus are being distributed via fake streaming apps, capable of overlaying fake bank login screens, intercepting OTPs, and reading saved passwords. Fortinet found 1,700+ spoofed FIFA social media accounts and hundreds of thousands of stolen credentials already circulating. Kaspersky found 10-12% of Wi-Fi networks in Mexican host cities are open and vulnerable to evil twin attacks. Estimated losses from ticket fraud alone range from $71M to $474M. Key red flags include crypto payment requests, streaming apps asking for accessibility permissions, and FIFA domains reached via ads or search results rather than direct URL entry.
