World Cup fraud in full effect as security researchers uncover fake FIFA sites and banking malware inside streaming apps

With just days remaining until the June 11, 2026, kickoff of the FIFA World Cup across North America, global cybersecurity firms and the FBI have issued an urgent warning regarding a massive, highly organized cybercrime ecosystem actively targeting eager football fans. Driven by extreme ticket scarcity and immense streaming demand, threat actors have deployed thousands of lookalike domains and malicious applications designed to hijack bank accounts, drain cryptocurrency wallets, and steal personal data.

Editorial credit: Djem / Shutterstock

The sudden surge in malicious infrastructure has been heavily documented by security researchers at Fortinet's FortiGuard Labs, who tracked more than 13,000 newly registered World Cup-themed domains in the first five months of the year alone. Analysts found that roughly nine percent of these addresses are explicitly malicious or highly suspicious.

The "GHOST STADIUM" Account Takeover Trap

One of the most sophisticated operations identified is a money-driven campaign dubbed "GHOST STADIUM" by researchers at Group-IB. The threat group is currently running a highly advanced phishing kit across more than 300 perfectly cloned FIFA ticketing websites.

To evade automated brand-protection tools that scan the web for copied assets, the fake sites are engineered to pull their official graphics and images directly from FIFA’s live servers in real time. The fraudulent pages mimic the genuine single sign-on identity verification interface down to the exact client identification parameters.

When an anxious fan attempts to log in to buy or verify scarce tickets, the clone site prompts a mandatory password reset. Once the victim inputs their current and new credentials, the attackers instantly seize control of the real account, locking the legitimate owner out and allowing the fraudsters to exfiltrate and resell any digital match tickets tied to the user's profile on secondary markets.

Trojanized streaming apps

Beyond web-based credential phishing, a far more severe financial threat has emerged in the mobile application space. Mobile security researchers at ThreatFabric and Kaspersky have reported a massive spike in unofficial, third-party Android streaming applications capitalizing on fans who lack access to official tournament broadcasters.

Many of these malicious files are distributed through social media links, Telegram channels, and alternative app storefronts, frequently masquerading as popular pirate streaming utilities like RojaDirecta.

Once a user manually overrides Android’s default safety warnings to install the application package, the software unmasks itself as a powerful banking trojan. Instead of playing a live video feed, the malware immediately requests permission to utilize Android’s native Accessibility Services, a critical red flag, as legitimate media players have no operational reason to demand deep system automation rights.

Once granted, the trojan takes complete, remote control of the handset. It can dynamically overlay pixel-perfect fake login screens over legitimate banking and cryptocurrency applications, log every single keystroke typed by the device owner, and silently harvest saved passwords or recovery phrases from localized note-taking apps.

Worse still, the malware's accessibility permissions allow it to intercept incoming SMS text messages and authenticator app notifications. This completely neutralizes traditional two-factor authentication protections, enabling the criminal operators to authorize large, fraudulent wire transfers and drain the victim’s financial accounts entirely in the background.

Operational Safeguards and Immediate Recommendations

The FBI’s Internet Crime Complaint Center (IC3) has published an advisory detailing the specific domain naming conventions favored by the fraudsters, highlighting typo-squatting domains that rely on minor user misspellings, such as alternate top-level extensions or modified subdomains like "jobs-fifa" and "26-fifa", to trick users navigating search results.

Individual fans are strongly urged to type the official web address directly into their browsers, strictly avoid any "sponsored" search engine results that may lead to paid imitators, and immediately delete any mobile application that requests system accessibility permissions under the guise of an entertainment stream.