The FBI Just Warned 6.5 Million World Cup Fans. Your Business Has a Problem Too.

Breaking News Phishing Alert

June 2026  ·  7 min read

The 2026 FIFA World Cup kicks off June 11. The FBI has issued a formal warning: more than 4,300 fake FIFA websites are already live, designed to steal credentials and payment details from fans desperately searching for tickets. What the FBI warning doesn't say is what those stolen credentials mean for the businesses those fans work for.

---

On May 27, 2026, the FBI's Internet Crime Complaint Center published a formal public service announcement: cybercriminals are conducting coordinated spoofing attacks against FIFA's official website. The fake sites are pixel-perfect replicas — cloned branding, cloned checkout flows, cloned single sign-on authentication pages. They're promoted through Facebook ads, Google sponsored results, Telegram, and WhatsApp. They're designed to steal exactly three things: your personal information, your payment details, and your login credentials.

Cybersecurity firm Group-IB identified more than 4,300 fraudulent FIFA domains registered since August 2025. Four independent criminal groups are running simultaneous campaigns. At the center is a Chinese-speaking operation tracked as Ghost Stadium, which has built a pixel-perfect clone of the official FIFA website across more than 300 domains — complete with single sign-on authentication flows in 11 languages. An additional 3,800 domains are dormant, pre-positioned to activate as the tournament approaches.

Here's the number that matters for your business: researchers have already found 2,513 FIFA account credentials on the dark web — real usernames and passwords harvested from fake FIFA sites and available for purchase right now. Those credentials belong to real people. Some of those people work for your business. And some of them use the same password on their FIFA account that they use at work.

4,300+ fraudulent FIFA domains registered since August 2025 — 300+ active, 3,800 dormant and ready to activate Group-IB / FBI IC3, May 2026

2,513 FIFA account credentials already found on the dark web — harvested from fake sites, available for purchase now Group-IB, May 2026

150M ticket requests in the first 15 days of sales — 30x oversubscribed. Desperation is the attacker's advantage. FIFA / Help Net Security, 2026

⚠️ FBI formal warning — issued May 27, 2026 "Cyber threat actors are conducting spoofing attacks against the Fédération Internationale de Football Association (FIFA) website in advance of the 2026 FIFA World Cup." The FBI has published a list of known fraudulent domains and warns that additional fake websites are likely to appear throughout the tournament period. Report incidents at ic3.gov.

Why this is a business problem, not just a fan problem

The FBI warning is framed as consumer advice. Type the URL directly. Avoid sponsored links. Don't click suspicious emails. That's the right advice for an individual fan. But the business risk runs deeper — because of a single documented behavior: password reuse.

We covered this in the credential series. 94% of leaked passwords are reused. An employee who creates an account on a fake FIFA site and enters their email and password has just handed attackers a credential that — statistically — is likely to work on at least one of their other accounts. Including, potentially, their work email, their company VPN, or their Microsoft 365 login.

The attacker doesn't need to target your business directly. They target the World Cup fan. The fan happens to work for you. The fan reused their password. Your business is now exposed through an attack that never touched your systems, never triggered your security tools, and won't show up in any monitoring until 292 days later when someone notices unusual access.

The 2,513 FIFA credentials already on the dark web are being tested against other services right now. Credential stuffing — taking leaked username/password pairs and automatically testing them across hundreds of platforms — is fully automated and runs 24 hours a day. If any of those 2,513 credentials belong to your employees and if any of those employees reused that password at work, your business already has a problem. You just don't know it yet.

What the fake sites actually look like

These are not obvious scams. Ghost Stadium's cloned sites replicate the PingIdentity single sign-on flow that FIFA uses for authentication — meaning when an employee tries to "log in with Google" or "log in with their FIFA account," they're entering credentials into a system that captures and forwards them to attackers while appearing to complete the login normally. The employee may never know anything went wrong.

Spot the fake — real vs fraudulent FIFA domains

✓ Real:www.fifa.com

✗ Fake:fifa-ticket.live

✗ Fake:fifaworldcup26.sale

✗ Fake:fiffa.com       (one extra letter)

✗ Fake:fifa.house     (different domain)

✗ Fake:jobs-fifa.com  (impersonating FIFA jobs)

✗ Fake:fifa.city      (alternative TLD)

Note:3,800+ additional domains pre-registered and dormant — ready to activate during the tournament

The five things to do in your business before June 11

1

Send a one-paragraph warning to your team today

Do it now

The single most impactful action in the next hour: message your team explaining that fake FIFA websites are actively stealing credentials, that the FBI has issued a formal warning, and that any FIFA account should use a completely unique password — not shared with any work system. Include one rule: type www.fifa.com directly into the browser. Never click a FIFA link from an email, ad, or social media post.

The message to send "The FBI has warned that thousands of fake FIFA World Cup websites are live right now, stealing login credentials. If you're buying tickets or checking match info, only use www.fifa.com typed directly into your browser — never click a link. And please make sure your FIFA password is different from any password you use for work."

2

Check whether any employee emails appear in the FIFA credential dump

Check today

Group-IB found 2,513 FIFA account credentials already on the dark web. HaveIBeenPwned at haveibeenpwned.com allows free domain-level searches — type your company domain and see which employee email addresses have appeared in known breach databases. If any work emails appear, those employees should change their work passwords immediately.

The 60-second check Go to haveibeenpwned.com → click "Domain search" → enter your company domain → review any breached accounts. This is the same check from Part 2 of the credential series. The World Cup credential dump is happening in real time — checking now gives you a window to act before the credentials are used.

3

Remind employees: sponsored search results are not safe results

Training moment

The FBI explicitly flagged this: attackers are buying Google sponsored placements that appear above the real FIFA website in search results. When an employee searches "buy FIFA World Cup tickets" and clicks the first result, they may be on a fake site before they've noticed the URL.

Two rules before June 11 Skip sponsored results (marked "Sponsored" above organic results), and always check the URL before entering any credentials. A locked padlock icon does not mean a site is legitimate — fake sites have SSL certificates too. The URL is the only reliable check.

4

This is the credential reuse attack in real time — MFA is your safety net

MFA enforcement

Even if an employee's work credentials are harvested through a fake FIFA site, MFA on all work accounts provides a critical second line of defense. The caveat from the MFA bypass post: push notification MFA can be defeated through prompt bombing. Number matching — the single configuration change that requires the employee to enter a code shown on the login screen — makes prompt bombing fail.

The specific action Confirm MFA is enforced on every work system — not just available, enforced. Enable number matching in your identity provider settings. This closes the gap between "credentials stolen via fake FIFA site" and "business compromised." It takes 15 minutes to configure.

5

The tournament runs until July 19 — this risk lasts 40 days

Duration matters

The 2026 World Cup runs from June 11 to July 19 — 40 days. The 3,800 dormant fake domains are pre-positioned to activate throughout the tournament. New campaigns will launch around knockout rounds, semifinals, and the final when ticket demand and urgency peak again.

The 40-day plan Send the initial warning today. Send a brief reminder when the knockout rounds begin (approximately July 4). Keep the haveibeenpwned domain search bookmarked and run it again mid-tournament. The fake domain ecosystem will evolve — new sites will launch and your team's awareness will fade with time.

The 2026 World Cup is the largest in history — 48 teams, 104 matches, 6.5 million fans across the US, Canada, and Mexico. There were 150 million ticket requests in the first 15 days alone, making it 30 times oversubscribed. Scammers don't need to trick a majority of those fans. They need to trick a fraction. And among that fraction, some will be your employees — using the same password they use at work.

The bigger lesson behind the World Cup scam

The 2026 World Cup phishing campaign illustrates why credential monitoring matters year-round. Your employees are not being targeted because of where they work. They're being targeted as consumers — as fans, as shoppers, as people who click on things. The credentials they lose in their personal lives become the credentials that walk into your business.

This is the same mechanism as the 17 billion stolen credentials on HaveIBeenPwned — passwords lost in one breach, reused in another context, eventually used to access a business system. The World Cup accelerates and focuses the risk. But the underlying vulnerability exists 365 days a year and 292 days before the average business finds out it was exploited.

Veriti Spottr's credential monitoring watches your company domain against known breach databases continuously — including new dumps like the FIFA credential data Group-IB found on the dark web. When an employee's work email appears in a new breach, Spottr surfaces it before the credential is tested against your systems. The World Cup campaign is already running. The 2,513 credentials Group-IB found were harvested before today. The question is whether any of them belong to your team — and whether you find out now or in 292 days.

📚 Credential Security Series — Read the full series

Part 1 → Your Password Policy Isn't Protecting You. Your Employees' Habits Are. Part 2 → Your Credentials Are Already For Sale. Here's How to Find Out in 60 Seconds. Part 3 → You Turned MFA On. Attackers Already Have Three Ways Around It. Part 4 → What Attackers Do With Your Data in the First 60 Minutes Part 5 → The 30-Minute Security Audit Every SMB Owner Should Do This Week Part 6 → The First 24 Hours After You Discover a Breach

Find out if your employees' credentials are already in the FIFA dump. Veriti Spottr's beta is free.

Get your CyberScore →

VS

Veriti Spottr Team AI-powered cyber risk clarity for SMBs  ·  veritispottr.com