300+ Fake Domains Used in GHOST STADIUM Campaign Targeting World Cup Fans

Group-IB researchers uncovered a sophisticated, large-scale phishing operation called “GHOST STADIUM” targeting 2026 FIFA World Cup fans by cloning FIFA’s site (including SSO) to steal credentials, payment data, and authorize password resets; the campaign leverages 4,300+ fraudulent domains, sells PhaaS kits on dark markets, and has already circulated thousands of valid credential pairs and SSL/infra overlaps that could result in hundreds of millions to billions in losses.