Cybercriminals Are Targeting the FIFA World Cup 2026

KnowBe4 ThreatLabs tracked a sustained, escalating FIFA/World Cup 2026-themed phishing campaign (pre-tournament through mid-tournament) that uses display-name spoofing, cloud service abuse (AWS WorkMail/SES, Desk365), redirect trackers, branded SSO credential harvesting, card-payment collection pages, and reply-only advance-fee fraud; the report provides telemetry on attack volume and timing, lists defanged IOCs and infrastructure pivots, and recommends blocking IOCs, display-name detection, time-of-click link analysis, and user education.