Chinese Origin Threat Actors Target FIFA World Cup 2026

CloudSEK's TRIAD discovered a large, active multi‑tenant phishing operation impersonating FIFA World Cup 2026 ticketing that combines typosquatted frontend clones, a Chinese‑language admin/payment backend (tbpay.uk), and tawk.to live chat to perform real‑time card skimming and OTP interception (enabling SMS 2FA bypass and account takeover). The report provides technical evidence (exposed PHP debug variables, database name fifa_ming, session logs), a list of IOCs (domains, IPs, tawk.to property ID), operator activity timestamps, and tailored recommendations for banks and consumers.