The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament

Group-IB discovered a large, financially motivated fraud ecosystem targeting FIFA World Cup 2026 fans: a core Chinese-speaking threat actor dubbed "GHOST STADIUM" operates 300+ pixel-perfect phishing domains cloning FIFA's SSO and ticket flows, backed by a broader network of ~4,300 registered impersonator domains, supply‑chain PhaaS sellers, mass infostealer logs (Vidar, Lumma) and multi-rail payment channels; estimated losses for premium ticket fraud are $71M–$474M with total campaign profits potentially reaching into the billions, and the report provides IOCs and a coordinated Cyber Fraud Fusion defence model to mitigate impact.