The Federal Bureau of Investigation (FBI) issued Public Service Announcement Alert I-052726-PSA on May 27, 2026, warning that threat actors are actively conducting spoofing campaigns against FIFA-themed websites ahead of the 2026 FIFA World Cup.
The campaign is designed to exploit global interest in the tournament by deceiving users into interacting with fraudulent domains that closely mimic the official FIFA website.
Spoofed websites replicate the look and branding of legitimate FIFA platforms, often featuring fake ticket sales, job listings, and merchandise portals.
The primary objective is to harvest personally identifiable information (PII), including names, addresses, phone numbers, email credentials, and financial data. In several cases, attackers also facilitate fraudulent transactions, such as selling non-existent World Cup tickets and counterfeit hospitality packages.
The attack technique largely relies on typosquatting and domain spoofing. Cybercriminals register domains with slight variations of the legitimate URL fifa.com, using misspellings, additional words, or alternative top-level domains (TLDs).
FBI identified examples include fifa[.]pink, fifa[.]ceo, filfa[.]org, fifa-ticket[.]live, and worldcup26ticket[.]com. More deceptive variants such as wvvw-fifa[.]com and fifa-com[.]com exploit visual similarities to deceive users at a glance.
Beyond simple domain spoofing, attackers are leveraging subdomain impersonation tactics, creating domains such as jobs-fifa[.]com and fifa-careerhub[.]com to target individuals seeking World Cup-related employment opportunities.
These domains frequently host phishing forms or malware-laced pages engineered to capture sensitive user data or initiate further system compromise.
The FBI warns that this malicious activity is expected to intensify as the 2026 World Cup approaches, with additional fraudulent domains likely to emerge through search engine results, sponsored advertisements, and phishing links distributed via email and social media campaigns.
Threat intelligence firm bfore.ai’s PreCrime Labs had already identified 498 suspicious FIFA-themed domains in the lead-up period, underscoring the scale of the operation.
To mitigate exposure, users are strongly advised to manually type the official FIFA website URL, www.fifa.com, directly into their browser’s address bar rather than relying on search engine links or sponsored results.
Security experts also recommend carefully verifying domain names before entering any credentials, using bookmarks for frequently accessed sites, and treating any website with poor design, suspicious redirects, or unsolicited requests for sensitive information as a threat indicator.
From a defensive standpoint, organizations and security teams should monitor newly registered domains related to FIFA and World Cup keywords, implement DNS filtering, and deploy threat intelligence feeds to detect emerging indicators of compromise (IOCs).
Browser isolation and endpoint protection solutions can further reduce organizational exposure to active phishing infrastructure.
Victims of such scams are encouraged to report incidents immediately to the FBI’s Internet Crime Complaint Center (IC3) at www.ic3.gov, providing details including the malicious domain, interaction history, and any financial transactions involved.
This campaign underscores the continued abuse of brand impersonation and event-driven phishing as highly effective social engineering tactics, particularly during high-profile global events where widespread public excitement can reduce individual vigilance.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 issued Public Service Announcement Alert I-052726-PSA on May 27, 2026, warning that threat actors are actively conducting spoofing campaigns against FIFA-themed websites ahead of the 2026 FIFA World Cup.){kind=link}