Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise

Executive summary: ESET researchers identified multiple typosquatted, FIFA-branded phishing websites that mimic official ticketing and merchandise flows for the FIFA World Cup 2026 to harvest payment details, personal data, and account credentials; victims face direct financial loss and increased risk of identity theft. The report documents registration and checkout deception, lists example impersonating domains, and provides practical mitigations such as using official channels, inspecting domains, avoiding reused passwords, and enabling two-factor authentication.