FIFA World Cup 2026 Phishing Campaign Steals Fan PII and Payment Cards

Cybercriminals are exploiting interest in the 2026 FIFA World Cup with phishing emails, fake prize promotions, and counterfeit ticketing sites designed to steal personal and financial data from fans. Researchers said the campaign uses convincing World Cup branding and legitimate-looking emails that pass standard authentication checks, then pushes victims through multi-step redirect chains that help the activity evade spam filters and automated analysis before landing on fraudulent reward or checkout pages.

The infrastructure includes clusters of FIFA-themed domains and mobile-focused phishing pages that imitate official ticket sales and promotion workflows, collecting names, email addresses, phone numbers, home addresses, and full payment card details. Investigators reported some pages used geo-cloaked redirectors to show content only in selected regions, while others referenced payment-related JavaScript tied to services such as KOIpay and EBpay; some victims were ultimately redirected to online gambling platforms instead of legitimate tournament services.