Threat actors are actively launching spoofing campaigns targeting FIFA-themed websites ahead of the 2026 FIFA World Cup, according to a Public Service Announcement (Alert I-052726-PSA) issued by the Federal Bureau of Investigation (FBI) on May 27, 2026.
The campaign is designed to exploit global interest in the tournament by deceiving users into interacting with fraudulent domains that closely mimic the official FIFA website.
FIFA Website Spoofing Campaign
These spoofed websites replicate the look and branding of legitimate FIFA platforms, often featuring fake ticket sales, job listings, and merchandise portals.
The primary objective is to harvest personally identifiable information (PII), including names, addresses, phone numbers, email credentials, and financial data. In some cases, attackers also attempt to facilitate fraudulent transactions, such as selling non-existent World Cup tickets or hospitality packages.
The attack technique largely relies on typo-squatting and domain spoofing. Cybercriminals register domains with slight variations of the legitimate URL “fifa.com,” such as misspellings, additional words, or alternative top-level domains (TLDs).
Examples identified by the FBI include FIFA.]pink, fifa[.]ceo, filfa[.]org, fifa-ticket[.]live, and worldcup26ticket[.]com. More deceptive variants include domains like wvvw-fifa[.]com and fifa-com[.]com, which exploit visual similarities to trick users.
Additionally, attackers are leveraging subdomain impersonation tactics, creating domains such as jobs-fifa[.]com and fifa-careerhub[.]com to target individuals seeking employment opportunities related to the World Cup. These domains often host phishing forms or malware-laced pages designed to capture sensitive user data or initiate further compromise.
The FBI warns that this activity is expected to increase as the 2026 World Cup approaches, with more fraudulent domains likely to emerge. Users may encounter these malicious sites via search engine results, sponsored advertisements, or phishing links distributed through email and social media campaigns.
To mitigate the risk, users are advised to manually enter the official FIFA website URL (www.fifa.com) into their browser instead of relying on search engine links.
Security experts also recommend avoiding sponsored search results, verifying domain names carefully, and using bookmarks for frequently accessed sites. Users should be cautious of poorly designed websites, suspicious redirects, and any request for sensitive information on unfamiliar platforms.
From a defensive standpoint, organizations and security teams should monitor newly registered domains related to FIFA and World Cup keywords, implement DNS filtering, and deploy threat intelligence feeds to detect emerging indicators of compromise (IOCs). Browser isolation and endpoint protection solutions can further reduce exposure to phishing infrastructure.
Victims of such scams are encouraged to report incidents to the FBI’s Internet Crime Complaint Center (IC3), providing details such as the malicious domain, interaction history, and any financial transactions involved.
This campaign highlights the continued use of brand impersonation and event-driven phishing as effective social engineering tactics, particularly during high-profile global events where user vigilance may be reduced.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
