Chinese-speaking fraud gang could be stealing millions from 2026 World Cup fans

Group-IB discovered a Chinese-speaking fraud group dubbed GHOST STADIUM operating a large, sophisticated phishing operation that cloned FIFA's website across 300+ active domains (and ~4,300 related domains) to steal credentials and payment details from 2026 World Cup fans. The campaign used a Layui-based phishing kit that replicates FIFA's authentication flow (including silent redirects and password-reset parameters to lock victims out) and was distributed via paid Facebook ads; researchers observed shared SSL certificates and Meta Pixel IDs tying the infrastructure together and estimated tens of thousands of victims with potential losses in the millions-to-billions of dollars.