Loading story…
Vesal Security reported a large-scale automated fraud operation targeting FIFA World Cup 2026 ticket draws from May 2024 through July 2026. The assessment attributes the creation of 1,373,231 FIFA accounts and 710,521 successful draw applications to two automation providers, Firefly and ConsolDes, with six services allegedly offering account creation, draw registration, password resets, and bypasses for anti-bot controls including DataDome and Akamai.
The operators allegedly resold successful allocations and tickets on online forums, while using the same tooling against co-sponsor promotions and a European football federation's ticket allocations. Organizations operating high-demand ticketing or promotional systems should review account-creation, draw-entry, and resale-abuse telemetry, and strengthen controls against automated registration and anti-bot evasion; the report's claims should be treated cautiously because its stated fact-verification score was 40/100 and it supplied no extractable indicators of compromise.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
On July 31, 2026, Vesal Security published an assessment attributing 1,373,231 FIFA account creations and 710,521 successful ticket-draw applications to Firefly and ConsolDes. The assessment also reported ticket selections and tickets being offered for resale on secondary forums.
From July 7, 2026, Coalpit reportedly offered retail-account creation under a World Cup-related pretext.
From November 3, 2025, Hades reportedly offered browser- and request-based account creation capabilities with Akamai handling.
From September 10, 2025, Ironwood and Palewater reportedly offered anti-bot bypass capabilities against fifa.com. Ironwood's capabilities targeted DataDome and Akamai protections.
From September 30, 2024, Firefly reportedly offered FIFA account creation and ticket-draw entry capabilities, as well as functionality targeting sponsor promotions.
From September 2, 2024, ConsolDes reportedly offered FIFA account creation, repeated ticket-draw entry, and password-reset capabilities.
The first version of a tool linked to the FIFA ticketing automation campaign was published in September 2024, approximately 21 months before the tournament.
Vesal Security's assessment describes a fraudulent automation operation targeting FIFA World Cup 2026 ticketing as active from May 2024 through July 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals launched multiple parallel fraud campaigns around the 2026 FIFA World Cup, using fake merchandise stores, cloned FIFA portals, bogus ticketing and betting sites, QR-code and SMS lures, and cryptocurrency scams to steal credentials, payment card data, and personal information. Researchers reported more than 13,000 FIFA-themed domains registered between January and May 2026, with a notable share deemed malicious or suspicious, while one purchase-scam cluster alone used about 33 domains and roughly 2,500 online ads to impersonate major sports brands and push victims into WhatsApp-based social-engineering funnels. Analysts also identified persistent portal-cloning kits with mirrored SSO flows and hundreds of static HTML files, as well as rapidly rotated betting and traffic-monetization domains that redirected users through affiliate-tracked overlays and iframes.
Jul 22, 2026
Cybercriminals are exploiting interest in the **2026 FIFA World Cup** with phishing emails, fake prize promotions, and counterfeit ticketing sites designed to steal personal and financial data from fans. Researchers said the campaign uses convincing World Cup branding and legitimate-looking emails that pass standard authentication checks, then pushes victims through multi-step redirect chains that help the activity evade spam filters and automated analysis before landing on fraudulent reward or checkout pages. The infrastructure includes clusters of FIFA-themed domains and mobile-focused phishing pages that imitate official ticket sales and promotion workflows, collecting names, email addresses, phone numbers, home addresses, and full payment card details. Investigators reported some pages used geo-cloaked redirectors to show content only in selected regions, while others referenced payment-related JavaScript tied to services such as `KOIpay` and `EBpay`; some victims were ultimately redirected to online gambling platforms instead of legitimate tournament services.
Jul 7, 2026
A phishing and fraud operation impersonating **FIFA** ahead of the 2026 World Cup has expanded far beyond initial estimates, growing from 79 known domains on 14 IPs to at least **222 domains** spread across **203 unique IP addresses**. The sites mimic official FIFA branding, copy page structure, and reuse images and icons from the legitimate website to lure fans through typosquatted and lookalike domains such as `vww-fifa[.]com` and `fifa[.]sale`. Researchers said the infrastructure is designed to steal credentials and payment data, collect money for fake tickets or merchandise, and potentially compromise legitimate FIFA accounts so real tickets can be stolen and resold. The latest investigation found the activity is not a single centralized campaign but at least **four distinct operator clusters** sharing scam templates while differing in hosting, registration patterns, and WHOIS fingerprints. Analysts linked parts of the infrastructure to repurposed aged `.shop` domains, a smaller `.cn` cluster, and domains using the fake registrant organization **"888 World Cup Management Co Ltd."** Most of the sites sit behind **Cloudflare**, which independently flagged several as phishing, and **206 of the 222 domains** were still active at the time of reporting, with registrations accelerating in April. Researchers urged broader detection beyond obvious FIFA-themed names and called for registrar-level disruption, particularly involving **GNAME.COM** and **GoDaddy**.
Jul 30, 2026