Loading story…
A white-hat researcher known as BobDaHacker disclosed a now-patched authorization flaw in a FIFA World Cup 2026 platform that allegedly exposed multiple internal systems, including production tools used to manage global TV broadcasts. After registering through FIFA’s licensed player-agent platform, the researcher was added to FIFA’s Microsoft Entra environment and discovered back-end APIs that relied on client-side authorization checks, enabling access to broadcaster-facing panels, live stadium camera feeds, commentators’ displays, and other internal applications.
According to the researcher, the exposed systems included a streaming management panel containing RTMP ingest URLs and stream keys, which could have allowed an attacker to replace or disrupt live match video across all camera feeds. Additional reachable platforms reportedly included live score dashboards, play-metrics tracking, and match-management tools where match times and scores might have been altered. After unsuccessful attempts to contact FIFA directly, the researcher notified MediaKind, CISA, and the FBI; FIFA reportedly patched the flaw within hours and did not publicly comment.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
According to the researcher, FIFA fixed the vulnerability within a few hours of disclosure, by the following morning, though without acknowledging her report. The patch reportedly closed access to systems that could have been used to alter live streams, scores, and match data.
BobDaHacker said she reported the authorization flaw on Tuesday night Japan time after unsuccessful attempts to contact FIFA directly, including notifying MediaKind, CISA, and the FBI. The report concerned potential access to production streaming controls and other internal FIFA systems.
A security researcher using the handle BobDaHacker said that after registering on FIFA's official licensed-agent/player-agent platform, she was added to FIFA's Microsoft Entra environment and discovered backend APIs that relied on client-side authorization checks. The flaw allegedly exposed access to internal World Cup systems, including streaming and match-management platforms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcegovinfosecurity.com
Open sourcebobdahacker.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing and fraud operation impersonating **FIFA** ahead of the 2026 World Cup has expanded far beyond initial estimates, growing from 79 known domains on 14 IPs to at least **222 domains** spread across **203 unique IP addresses**. The sites mimic official FIFA branding, copy page structure, and reuse images and icons from the legitimate website to lure fans through typosquatted and lookalike domains such as `vww-fifa[.]com` and `fifa[.]sale`. Researchers said the infrastructure is designed to steal credentials and payment data, collect money for fake tickets or merchandise, and potentially compromise legitimate FIFA accounts so real tickets can be stolen and resold. The latest investigation found the activity is not a single centralized campaign but at least **four distinct operator clusters** sharing scam templates while differing in hosting, registration patterns, and WHOIS fingerprints. Analysts linked parts of the infrastructure to repurposed aged `.shop` domains, a smaller `.cn` cluster, and domains using the fake registrant organization **"888 World Cup Management Co Ltd."** Most of the sites sit behind **Cloudflare**, which independently flagged several as phishing, and **206 of the 222 domains** were still active at the time of reporting, with registrations accelerating in April. Researchers urged broader detection beyond obvious FIFA-themed names and called for registrar-level disruption, particularly involving **GNAME.COM** and **GoDaddy**.
Jul 30, 2026
Palo Alto Networks Unit 42 warned that the **2026 FIFA World Cup** will present an unusually broad cyberattack surface because the tournament spans 16 host cities across the United States, Canada, and Mexico and will depend on temporary event networks layered onto existing stadium and municipal systems. The report said likely targets extend beyond venues to **transit, power, water, airports, emergency services, hotels, suppliers, ticketing platforms, and official digital services**, creating multiple paths for disruptive intrusions during the competition window. The assessment identified **Iran-linked actors**, including **Handala Hack Team** and **CyberAv3ngers**, as notable risks for destructive activity and **OT/PLC** targeting, while **NoName057(16)** was highlighted for politically timed **DDoS** campaigns. Unit 42 said financially motivated cybercrime is also likely to focus on hospitality and fan-facing services through ransomware and fraud, and it urged organizers and host-city partners to strengthen multi-jurisdiction coordination, harden OT environments, audit suppliers, prepare DDoS defenses, run destructive-malware exercises, and tighten identity and help-desk controls before kickoff.
Jun 29, 2026
A threat actor allegedly leaked data from the Asian Football Confederation (**AFC**) and records tied to **Al Nassr FC**, claiming exposure of more than **150,000** player, coach, and member records on a cybercrime forum and the dark web. Reported samples included passport scans and numbers, contracts, verified email addresses, AFC registration files, AFC IDs, and detailed player information such as names, dates of birth, nationalities, club affiliations, match details, and venue data. The seller called it the "largest breach in football history" and invoked **ShinyHunters**, but Dataminr assessed that reference as likely an attempt to borrow the group’s reputation rather than evidence of direct affiliation. Researchers warned that the combination of identity documents, contract data, and verified contact information could enable **identity fraud**, **business email compromise**, contract manipulation, and highly targeted social engineering against athletes, coaches, and officials. Dataminr also noted that some allegedly leaked documents included diplomatic passports, expanding the potential impact beyond sports operations to tournament logistics and broader national security concerns as AFC member nations prepare for the 2026 FIFA World Cup. At the time of reporting, the AFC had not publicly commented on the alleged compromise, while security experts urged organizations to review athlete-data storage, third-party access, financial verification workflows, and monitoring for suspicious communications.
Jun 29, 2026