World Cup 2026 Mobile Targeted Phishing: The Global Social Engineering Threat

Zimperium documents three active, sophisticated phishing campaigns exploiting FIFA World Cup 2026 demand: (1) production-grade typosquatted ticket sites that harvest credentials and payment data, (2) a multi-language retail phishing (“RetailPhish”) propagated via WhatsApp and hidden behind Cloudflare and a unified registrar account, and (3) recruitment-themed AiTM platforms targeting corporate Google Workspace accounts to intercept MFA and perform session hijack — all posing significant mobile-to-enterprise risk with identified domains, infrastructure, and IoCs.