"The World Cup creates one of the most dangerous cyberattack windows on the planet," said Anne Cutler, Cybersecurity Evangelist at Keeper Security.
Ticketing scams: counterfeit sites and panic mechanics
Researchers from Fortinet’s FortiGuard Labs and other security teams warn that ticketing scams are among the highest-risk lures tied to the 2026 FIFA World Cup. The research identified several counterfeit ticketing sites impersonating official FIFA pages and more than 4,300 fraudulent domains impersonating FIFA’s web presence. Attack campaigns use paid Facebook ads, countdown timers and fake pricing to manufacture urgency — tactics designed to push fans into making impulsive purchases.
Hoxhunt co-founder and CEO Mika Aalto noted scale as a force multiplier: more than 150 million ticket requests were filed within the first two weeks of World Cup sales, creating the emotional state attackers exploit. One coordinated ticketing campaign is estimated to have generated losses ranging from $71 million to nearly half a billion dollars, according to the researchers cited in the reporting.
FIFA-themed impersonation on social platforms
The attack surface on social media is expanding: researchers discovered more than 1,700 fraudulent, FIFA-themed accounts, and 90% of those were hosted on Facebook or Instagram. These accounts amplify misinformation, ticket scams and fraudulent promotions, increasing reach and accelerating deception cycles during the tournament.
Collin Hogue-Spears, Senior Director of Solution Management at Black Duck, linked this spread to email and identity paths — noting that over a third of FIFA’s sponsors and suppliers had no Domain-based Message Authentication, Reporting, and Conformance (DMARC) record on their mail domains. In Black Duck’s words, that absence means "a criminal crew does not need to forge anything to spoof them." The group advised sponsors, broadcasters and suppliers to run purple-team exercises, implement phishing-resistant MFA and enforce DMARC across owned domains.
Malware, apps and a mobile-first threat model
Malicious applications and trojanized software are highlighted as major delivery methods. FortiGuard Labs and other researchers reported malware being delivered via FIFA-related third-party sites and malicious apps — a particular concern in an era of betting apps and livestreaming tools. Threats named include credential theft, spyware, remote access tools and other malware types.
Kern Smith, Vice President of Global Solutions at Zimperium, framed the tournament as a mobile security stress test: roughly 6.5 million fans are expected across the U.S., Canada and Mexico, producing spikes in roaming traffic and device usage for tickets, payments and authentication. Zimperium and cited reporting from Kaspersky emphasized scams using fake ticketing offers, fraudulent accommodation listings and spoofed transportation applications designed to harvest credentials and financial information before travelers arrive.
Credential exposure and identity as the control plane
Exposure of credentials was a central finding: researchers discovered 260 FIFA employee credentials and more than 270,000 credentials from users of FIFA-related websites in stealer log data. While the presence of those credentials in logs "doesn’t indicate all credentials are being abused," the report warned they could enable account takeovers, impersonation, fraud, credential stuffing and targeted phishing.
Rex Booth, CISO at SailPoint, emphasized identity security: change passwords frequently, enable multi-factor authentication and treat identity as "the new control plane." Anne Cutler urged fans and IT leaders to "go directly to official sites, use strong and unique passwords on every account, and enable multi-factor authentication everywhere possible," and she added a public‑Wi‑Fi warning: "Don’t conduct any transactions involving personal or financial information over public Wi‑Fi."
What this means for technologists, event organizers, and fans
- Technologists and security teams: run purple-team exercises against identity and email paths, implement phishing-resistant MFA on vendor and volunteer accounts, and enforce DMARC on owned domains within the short time window called out by Black Duck.
- Event organizers and suppliers: adopt an edge-to-core defense posture that includes real-time visibility into mobile devices and applications, per Zimperium’s recommendation, and prioritize identity hygiene to reduce the leverage stolen credentials provide.
- Fans and travelers: follow Cutler’s guidance — use official ticketing and transportation apps, avoid installing apps from QR codes or links in messages, update devices before travel, and treat unexpected authentication prompts or messages with heightened suspicion.
The aggregate picture is blunt: vast demand, polished impersonation campaigns and a mobile-first attack vector create a concentrated opportunity window for opportunistic cybercriminals. Security leaders quoted in the research urged a mixture of immediate technical hardening — DMARC, phishing‑resistant MFA, identity controls — and practical consumer precautions so that a global sporting event does not become a global crime opportunity.
Source: Security Magazine — Security Experts Discuss Threats to FIFA World Cup 2026
