Threats to the 2026 FIFA World Cup

This Recorded Future Insikt Group report assesses a broad threat environment for the 2026 FIFA World Cup across physical security, cybercrime, state-sponsored espionage, hacktivism, and influence operations: it documents active World Cup-themed purchase scams and phishing infrastructure, credential exposures and dark‑web listings, ransomware incidents affecting football organizations, and likely APT and hacktivist targeting by Russian, Chinese, and Iranian-linked clusters, while providing mitigation guidance and escalation indicators for organizers and affiliates.