More than 4300 fraudulent domains impersonating FIFA's official web presence have been registered since last August, building a fraud operation aimed squarely at fans of the 2026 FIFA World Cup.
According to new analysis from Group-IB, the activity spans six fraud schemes and four independent threat actors working the same event at once.
Most of the domains sit dormant, ready to switch on as kickoff nears. The firm flagged a comparable surge of scam sites before the 2022 Qatar World Cup.
Cloned Site Pushed via Facebook Ads
At the center of the operation is an actor the company tracks as Ghost Stadium, which it describes as Chinese-speaking and profit-driven. It runs more than 300 phishing domains built on a single kit that reproduces fifa.com as an almost flawless replica, down to the site's PingIdentity single sign-on (SSO) flow.
The pages pull FIFA logos and product images from the brand's official content network so they look authentic while sidestepping image-matching detection.
Chinese-language notes left in the source code, alongside an interface that switches across 11 languages, including three Chinese variants, pointed investigators toward a Chinese-speaking developer.
Paid Facebook ads are the campaign's main engine, with shared Meta tracking codes tying hundreds of domains back to the same advertising accounts.
A Wider Fraud Economy
Ghost Stadium is one of the four operators Group-IB identified. The others include a bulk domain squatter, a phishing-as-a-service (PhaaS) supply chain selling ready-made kits and broad infostealer campaigns built for credential theft.
Dominated by the Vidar and Lumma infostealer families, those infections have swept up around 2500 FIFA logins now trading on dark-web markets.
The money moves through several channels, including a cryptocurrency on-ramp that settles funds beyond recovery.
Group-IB estimates premium and hospitality ticket fraud alone could cost victims between $71m and $474m, and warns losses across the full campaign could reach into the billions.
For fans, the safest course is to buy only through fifa.com, treat any ticket offer that demands cryptocurrency as a scam and turn on multi-factor authentication (MFA) before the rush begins.
For brand protection and fraud teams, the firm advises watching the dormant domains for signs of activation and pursuing takedowns at the registrar level rather than chasing sites one by one.