As the 2026 World Cup Looms, a Shadow Tournament of Cyber Fraud Begins

Security researchers and authorities warn of a large, sophisticated online fraud campaign exploiting the 2026 FIFA World Cup: attackers have created thousands of spoofed domains, fake ticket and travel pages, counterfeit vendor portals, malicious betting and streaming apps, and data-harvesting sites that harvest banking credentials and personal data. ESET analysts and the FBI have flagged the activity (approximately 4,300 fake domains), noting tactics such as cloned certificates, regionally localized pages, disposable registration emails, and excessive mobile app permissions that increase risk to consumers.