Threats to the 2026 FIFA World Cup

What Happened

A comprehensive threat assessment has revealed significant physical and digital security risks surrounding the 2026 FIFA World Cup. Fans, corporate sponsors, and event organizers are actively being targeted by online scammers and international espionage groups. This matters because criminals are setting up fake merchandise stores to steal credit card details, while foreign governments are likely to use the event to spy on high-profile attendees and spread political propaganda. To stay safe, individuals should only purchase tickets and goods from official sources, and organizations should actively monitor for fake websites impersonating their brand.

Key Takeaways

• Cybercriminals are heavily exploiting World Cup branding via fake online stores, purchase scams, and phishing to harvest payment data and PII.
• State-sponsored actors from Russia, China, and Iran will likely use the tournament for intelligence collection targeting VIPs, telecommunications, and logistics.
• Iran and Russia pose an elevated risk of conducting disruptive cyber operations or proxy hacktivism to advance geopolitical objectives.
• Physical security risks remain a high priority, with organized crime threats in Mexico and risks to soft targets from violent extremists in the US.
• Influence operations surrounding the event are currently overt, focusing on host-country legitimacy, visa access, and geopolitical tensions.

Affected Systems

• Ticketing platforms
• E-commerce payment gateways
• Telecommunications providers
• Hospitality and travel infrastructure
• Mobile wallets

Attack Chain

Financially motivated threat actors establish fake FIFA-branded domains and compromise legitimate websites to manipulate search engine visibility. Victims are lured to these fraudulent stores via online advertisements and search redirects. Once on the site, victims attempt to purchase merchandise or tickets, resulting in the theft of their payment card data, personally identifiable information (PII), and potential enrollment in mobile wallet fraud schemes. The stolen credentials and payment data are subsequently monetized on dark web forums or used to facilitate further social engineering attacks.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article provides strategic threat intelligence and high-level indicators but does not include specific detection rules or queries.

Detection Engineering Assessment

EDR Visibility: Low — The primary cyber threats discussed (purchase scams, typosquatting, credential harvesting via fake domains) occur on external infrastructure and do not typically involve malware execution on corporate endpoints. Network Visibility: High — Network telemetry, DNS logs, and web proxy data are highly effective for identifying traffic to newly registered typosquat domains or known scam infrastructure. Detection Difficulty: Moderate — While detecting known bad domains is straightforward, the sheer volume of legitimate World Cup traffic makes it challenging to distinguish sophisticated typosquats or compromised legitimate sites without dedicated brand monitoring tools.

Required Log Sources

• DNS Query Logs
• Web Proxy Logs
• Email Gateway Logs

Hunting Hypotheses

Control Gaps

• Lack of visibility into personal devices used by attendees for ticketing and purchases
• Inability to monitor external social media and search engines for brand impersonation without specialized digital risk protection tools

Key Behavioral Indicators

• High volume of newly registered domains matching event branding
• Unexpected redirects from legitimate but compromised websites to unknown e-commerce platforms
• Merchant account reuse across multiple suspicious domains

False Positive Assessment

• Medium

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting.
• Consider blocking the identified fraudulent domains (e.g., onlinefifavip-eu.shop, fifafanstorehub.com) at your network perimeter.
• Evaluate whether proactive password resets are necessary for any corporate credentials recently exposed in third-party data breaches.

Infrastructure Hardening

• Consider implementing strict DMARC, SPF, and DKIM policies to prevent email spoofing of corporate domains.
• If applicable, monitor and restrict access to configuration management databases (CMDBs) and network routing equipment to prevent unauthorized modifications by state-sponsored actors.

User Protection

• Consider enforcing multi-factor authentication (MFA) across all corporate accounts, particularly for executives and VIPs attending the event.
• Evaluate deploying mobile threat defense (MTD) solutions to protect users from smishing and mobile wallet fraud.

Security Awareness

• Consider educating employees on the risks of World Cup-themed phishing, purchase scams, and fake ticketing websites.
• If applicable, advise staff traveling to the event on physical security risks and the potential for device surveillance or confiscation at border crossings.

MITRE ATT&CK Mapping

• T1583.001 - Acquire Infrastructure: Domains
• T1584.001 - Compromise Infrastructure: Domains
• T1566.002 - Phishing: Spearphishing Link
• T1056.003 - Input Capture: Web Portal Capture
• T1498 - Network Denial of Service