--- title: Home-Field Disadvantage: AiTM, QR-Code Phishing, and... description: Arctic Wolf Labs investigated the cybercriminal ecosystem surrounding the 2026 FIFA World Cup and found mature, mobile-first malicious infrastructure already... canonical: https://daily.dev/posts/home-field-disadvantage-aitm-qr-code-phishing-and-infostealers-at-the-2026-fifa-world-cup-rqq3rc1xz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Home-Field Disadvantage: AiTM, QR-Code Phishing, and Infostealers at the 2026 FIFA World Cup | daily.dev og:description: Arctic Wolf Labs investigated the cybercriminal ecosystem surrounding the 2026 FIFA World Cup and found mature, mobile-first malicious infrastructure already... og:url: https://daily.dev/posts/home-field-disadvantage-aitm-qr-code-phishing-and-infostealers-at-the-2026-fifa-world-cup-rqq3rc1xz og:image: https://api.daily.dev/og/posts/RQQ3Rc1XZ.png og:image:alt: Home-Field Disadvantage: AiTM, QR-Code Phishing, and Infostealers at the 2026 FIFA World Cup og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Home-Field Disadvantage: AiTM, QR-Code Phishing, and Infostealers at the 2026 FIFA World Cup **[Arctic Wolf](https://daily.dev/sources/arcticwolf)** · 18 min read · 0 upvotes · 0 comments ## Summary Arctic Wolf Labs investigated the cybercriminal ecosystem surrounding the 2026 FIFA World Cup and found mature, mobile-first malicious infrastructure already operational months before kickoff. Over 10,000 World Cup-themed domains were registered since January 2026 at ~2,000/month, with generative AI accelerating attack automation. Key threats include: a real-time adversary-in-the-middle (AiTM) phishing kit targeting Google Workspace accounts that defeats conventional MFA by relaying one-time codes in seconds; a weaponized 'Employee Handbook' PDF using QR-code phishing (quishing) to target host-city staff; a multi-stage Android APK delivering cryptocurrency mining malware; and a Windows infostealer that exfiltrates browser credentials, session tokens, and app data to attacker-controlled Telegram and Discord channels. Attackers are targeting not just fans but event organizers and supply chain staff. Defenders are advised to adopt phishing-resistant MFA (FIDO2/passkeys), treat QR codes as hostile by default, and hunt newly registered domains combining venue/city names with FIFA-related keywords. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Cybercriminals Are Targeting the FIFA World Cup 2026](https://daily.dev/posts/cybercriminals-are-targeting-the-fifa-world-cup-2026-34vdwpe9w) · FortiGuard Threat Research · 0 upvotes · 0 comments - [FIFA World Cup 2026 scams are live: fake sites and malware](https://daily.dev/posts/fifa-world-cup-2026-scams-are-live-fake-sites-and-malware-ialnzhor4) · The Next Web · 0 upvotes · 0 comments - [2026 FIFA World Cup Faces Surge in Cyber Threats](https://daily.dev/posts/2026-fifa-world-cup-faces-surge-in-cyber-threats-gufs6ff6f) · Dark Reading · 0 upvotes · 0 comments - [FIFA World Cup 2026 Scams Surge As Fake Sites Target Fans](https://daily.dev/posts/fifa-world-cup-2026-scams-surge-as-fake-sites-target-fans-wkiqivklq) · Cyble · 0 upvotes · 0 comments - [Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave](https://daily.dev/posts/tracking-over-35-000-fake-sites-in-the-2026-world-cup-scam-wave-w0l4ajhet) · Trend Micro · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/home-field-disadvantage-aitm-qr-code-phishing-and-infostealers-at-the-2026-fifa-world-cup-rqq3rc1xz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Home-Field Disadvantage: AiTM, QR-Code Phishing, and Infostealers at the 2026 FIFA World Cup","url":"https://daily.dev/posts/home-field-disadvantage-aitm-qr-code-phishing-and-infostealers-at-the-2026-fifa-world-cup-rqq3rc1xz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/home-field-disadvantage-aitm-qr-code-phishing-and-infostealers-at-the-2026-fifa-world-cup-rqq3rc1xz"},"datePublished":"2026-06-09T13:02:52.770Z","dateModified":"2026-06-09T13:03:19.989Z","description":"Arctic Wolf Labs investigated the cybercriminal ecosystem surrounding the 2026 FIFA World Cup and found mature, mobile-first malicious infrastructure already...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0eda558f0b1787b3cae8379031e2720a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0eda558f0b1787b3cae8379031e2720a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Arctic Wolf","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Arctic Wolf","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/30920b37616d4d80ad2b810a4b9f6b2e","url":"https://daily.dev/sources/arcticwolf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/home-field-disadvantage-aitm-qr-code-phishing-and-infostealers-at-the-2026-fifa-world-cup-rqq3rc1xz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,phishing","timeRequired":"PT18M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Arctic Wolf","item":"https://daily.dev/sources/arcticwolf"},{"@type":"ListItem","position":3,"name":"Home-Field Disadvantage: AiTM, QR-Code Phishing, and Infostealers at the 2026 FIFA World Cup"}]} ```