Securing the Pitch for 6 Billion People: How Previous Games Shaped the 2026 FIFA World Cup Cyber Threat Landscape

By KELA Cyber Intelligence Center

Executive Briefing

Primary Surface: 16 host cities across a tri-country hybrid supply chain (US, MX, CA).

Dark Web Exposure: Over 1.5 million compromised accounts tied to World Cup infrastructure detected on the dark web.

Critical Vector: Sophisticated AI-driven automated malware and multi-jurisdictional infrastructure mapping by threat actors.

Introduction

The 2026 FIFA World Cup is set to be a historic global event, but also a ‘perfect storm’: cybercriminals profiting from emotionally driven fans making time-sensitive purchasing decisions, and far more sinister threats of nation-state deception, infiltration and disruption.

Spanning 16 host cities across the United States, Canada, and Mexico, the tournament features an expanded format of 48 teams and 104 matches. With a projected global audience of over six billion viewers and roughly 6.5 million ticketed attendees from 150 million who tried to get one, the scale of this event is unprecedented.

However, this massive physical and digital footprint introduces an equally unprecedented cybersecurity challenge. The tournament relies on an immensely complex, interconnected "physical and digital hybrid supply chain" encompassing ticketing, broadcasting, hospitality, municipal services, city planners, transportation, and third-party vendors—meaning the failure of even a minor vendor could disrupt core operations, put future sponsorship dollars at risk, and create class-action suits.

In KELA’s latest Cyber Intelligence Center (CIC) threat report, 2026 FIFA World Cup: Threats & Predictions, our researchers dive deep into the converging threats facing organizers, host cities, sponsors, and fans. As KELA proudly supports host cities, municipal governments, and Law Enforcement Agencies (LEAs) across North America to secure their critical operations, our team has monitored these risks closely ahead of the June 11 kickoff—tracking threats ranging from state-sponsored espionage and geopolitical hacktivism to industrialized cybercrime, dark web credential exposure, and autonomous AI malware.

Here is a summary of the key threats targeting the 2026 FIFA World Cup ecosystem—and why organizations must transition to proactive, behavior-based security operations today.

1. The Geopolitical Arena: Nation-State APTs and Hacktivist Groups Targeting the World Cup

The World Cup isn't just a global sporting event — it's an opportunity for malicious actors. 

History tells us nation-states exploit major events to collect intelligence, demonstrate power, or prepare for future sabotage, and the critical infrastructure host cities rely on sits squarely in scope.

This is not hypothetical: the water and utility sector has repeatedly proven to be a target, from the ransomware attack that disrupted Atlanta-based water-infrastructure manufacturer Mueller Water Products, to standing warnings from CISA and the FBI about state-linked actors probing internet-exposed industrial control systems (ICS/OT) at U.S. water and energy facilities.

Against that backdrop, Advanced Persistent Threat (APT) groups aligned with Russia, Iran, and China pose the highest strategic risks:

• Russia (Intelligence, Influence & Proxy Noise): Russian activity works on two levels. Quietly, state-sponsored actors like APT28 focus on covert intelligence collection against Western government, defense, logistics, and transportation entities — the kind of access that maps event security planning. Loudly, pro-Russian hacktivist collectives generate public-facing noise through DDoS attacks, website defacements, and propaganda. Bridging the two is Russia's influence machinery: during the Paris Olympics, the group Storm-1679 (part of the Doppelganger network) produced the fake "Olympics Has Fallen" documentary series, using AI-generated voices of figures including Tom Cruise and, in a later installment, Elon Musk to amplify fears of violence and erode trust in the event.
• Iran (Conflict-Driven Sabotage & State-Aligned Hacktivism): With the regional conflict ongoing, the tournament is a politically sensitive target, and Iranian APTs are actively probing critical infrastructure and event-adjacent networks. Much of the visible activity, though, comes from state-aligned hacktivist personas rather than formal state units. The most prominent, Handala, recently claimed to have wiped over 200,000 systems at U.S. medical-tech company Stryker and doxxed FBI Director Kash Patel — the kind of high-impact, headline-seeking operation characteristic of these state-aligned groups.
• China (The "Lifeline Services" Strategy): Chinese operations are quietly infiltrating North American critical infrastructure that supports the World Cup, for long-term persistence rather than immediate disruption. The group Volt Typhoon has maintained unauthorized access to U.S. water and energy systems for over five years using "living off the land" techniques. Meanwhile, Salt Typhoon infiltrated at least nine major U.S. telecom carriers, including AT&T, and Verizon, gaining the ability to monitor call metadata and potentially disrupt communications during high-attendance matches.

Anonymous Threat to the World Cup

2. Industrial-Scale Cybercrime: FIFA World Cup Ticket Scams & Fraud

The immense demand for the tournament has mobilized financially motivated cybercriminals who are setting up sophisticated traps for fans. KELA’s monitoring has observed a surge in illicit activities, including:

An actor on CrackedTo was offering tickets for the FIFA World Cup

• Deceptive Infrastructure and the "Ghost Stadium" Threat: Cybersecurity researchers have tracked over 4,300 suspicious or counterfeit FIFA-related domains registered since August 2025. This includes massive, coordinated campaigns—such as the Chinese-speaking threat activity widely known in the industry as the "Ghost Stadium" operation—which deploy near-perfect replicas of the legitimate FIFA login portal using cloned Single Sign-On (SSO) flows to harvest credentials and payment information.
• The Tri-Country Visa Trap: Because fans must navigate U.S., Canadian, and Mexican immigration, scammers have set up fake authorization portals—such as the fraudulent "Amerivisa Travel" site—guaranteeing visa approval. Victims surrender passport numbers, itineraries, and selfie-based identity verification materials, leading to total identity theft.
• Hospitality Scams: Telegram groups, deliberately using slight misspellings like "FIFFA," are running advance-payment frauds for non-existent hotel rooms and Airbnbs.

3. Lurking in the Shadows: Leaked FIFA Credentials & Initial Access

Perhaps the most alarming findings in KELA's report stem from the deep and dark web, where the initial building blocks of a major cyberattack are already being traded.

Our CIC researchers identified over 1.5 million compromised accounts associated with FIFA-related domains circulating on the dark web.

Over 1.5 million compromised accounts associated with 2026 World Cup-related domains (Partial Information Presented Only) | KELA Platform

A deeper look at recent leaks reveals over 7,300 leaked credential instances for FIFA domains, with over 2,800 occurring between May 2025 and May 2026. This includes critical, plaintext credentials for FIFA's internal identity infrastructure, such as sts.fifa.com and sso.fifa.com.

This exposure extends heavily into the supply chain:

• The Supply Chain Weakness: In September 2024, an infostealer compromised a device that used an email address under the quantaservices.com (Quanta Services) domain—an Official Supporter of the Houston Host City—exposing a FIFA XenApp remote-access login page.

• Alleged FIFA Server Access for Sale (New York Servers): On March 12, 2026, a threat actor known as "t2m3g" posted on the ReHub forum claiming to sell internal Remote Desktop Protocol (RDP) and cloud console access to FIFA servers allegedly located in New York. If monetized by ransomware operators or APTs, this access could facilitate devastating data theft or operational disruption.

4. The AI Revolution: AI-Powered Malware & Autonomous Attacks

Artificial Intelligence has completely transformed how cyberattacks are executed in 2026, lowering the barrier to entry while supercharging state-sponsored espionage.

• The First Autonomous AI Spy: KELA’s State of Cybercrime 2026 report details a Chinese state-sponsored APT campaign in which 80-90% of the entire espionage operation was executed autonomously by an AI agent (leveraging Anthropic's Claude Code Tool). The AI independently discovered the target, wrote the exploit, and extracted the data.
• Next-Generation Malware: KELA has observed the rapid deployment of AI-driven malware, including Voidlink (a remote access trojan generated with minimal human supervision), PromptFlux (malware that dynamically queries Google Gemini to generate evasion code on the fly), PromptLock (AI-powered ransomware built on generated Lua scripts), and FruitShell (malware hard-coded with complex prompts specifically designed to confuse AI-enabled defensive monitors).

Defending the Ecosystem

Traditional defenses are no longer enough to secure an event of this magnitude. Organizations must transition to proactive, behavior-based security operations today.

Recommendations for Organizations

In our full report, KELA outlines comprehensive, actionable recommendations, including:

• Continuous Monitoring: Organizations must deploy continuous monitoring for lookalike domains and implement rapid takedown procedures.
• Bot-Management: Financial institutions and ticketing vendors must aggressively strengthen their bot-management capabilities to handle automated credential stuffing and fraud during massive ticket demand spikes.
• Supply Chain Resilience: Implement strict Zero Trust protocols for OT, critical infrastructure, and third-party vendor access.

Guidance for Fans and Attendees

• "Official-Only" Approach: Purchase tickets exclusively through the official FIFA ticketing portal or the official 2026 application.
• Verify Travel Services: When applying for travel authorizations like ESTA or eTA, always ensure the website ends in legitimate government extensions (.gov for the United States, .gc.ca for Canada, or .gob.mx for Mexico).

Empowering the Front Lines

As the 2026 FIFA World Cup approaches, KELA proudly supports host cities, municipal governments, and Law Enforcement Agencies (LEAs) across North America. By providing continuous, actionable cyber threat intelligence, we empower those on the front lines to detect, disrupt, and neutralize threats before they can impact the games, ensuring a safe and seamless experience for millions of fans.



Don’t let your organization be sidelined by cyber threats.

Get in-depth analysis of threat actor TTPs, dark web exposure data, and the crucial defensive strategies required to protect your networks during the world’s largest sporting event.