Trending Articles
Trending Topics
Trending
The 2026 FIFA World Cup is almost upon us, with football’s premier tournament kicking off on June 11. The bad news is that the cybercrime whistle has already blown, with everything from malicious FIFA-related domains and social media accounts to leaked and stolen credentials identified in a new threat intelligence report.
One cybersecurity expert has warned that this has created “an incredible operational window for criminal networks,” while another said that the threat goes beyond traditional network security challenges and has evolved into a “mobile security stress test”.
The newly published FIFA World Cup 2026 Threat Report by Fortinet’s FortiGuard Labs has analysed what it says has been “a substantial increase in cybercriminal activity” between January and May.
More than 13,000 FIFA-related domains were newly registered, which is to be expected considering the global nature of the event. Sadly, so is the fact that approaching 10% of these display malicious characteristics.
Now add the 1,700 social media accounts and channels that have popped up. Oh, and the prevalence of FIFA-related credentials within infostealer logs and breach datasets available on criminal forums.
It doesn’t take a genius to understand the risk posed to account security from targeted attacks.
While ticket scams are the most obvious of FIFA World Cup threats, the cybercrime window that has already opened lets attackers reach into a much broader grab-bag of threats.
“The true danger of many phishing schemes, like those leading up to and during the 2026 FIFA World Cup, lies in their ability to grant attackers access to credentials, enabling them to masquerade as trusted insiders,” warned Rex Booth, Chief Information Security Officer at SailPoint.
And the attackers know who to target; there is no groping around in the dark for victims here.
“They don’t need to phish blindly when LinkedIn reveals your name, your employer and your title,” said Anne Cutler, Cybersecurity Evangelist at Keeper Security. “They know the accounts you’re creating right now for streaming and ticketing almost certainly share a password with another more valuable account.”
This is why Cutler calls the World Cup one of the most dangerous cyber-attack windows on the planet, creating an incredible operational window for criminal networks. Those credentials get harvested, verified and deployed weeks or months later, Cutler warned, long after the final whistle has blown.
And, importantly, long after anyone might connect the breach to a World Cup ticketing site. “A fan who cuts corners in June becomes the entry point in September,” Cutler concluded.
So what can FIFA and everyone else do?
The enterprise security defence playbook is the same as it has always been. The security basics haven’t changed, nor have the controls. The Fortinet report makes this quite clear, recommending that security teams monitor for:
“They should also assess protections against phishing, malware, credential theft, and account takeovers,” Fortinet advised.
The big problem for the FIFA World Cup is sheer scale.
Collin Hogue-Spears, Senior Director of Solution Management at Black Duck, warns that “the attack surface is three countries, 16 host cities, and every vendor that shares a domain with the tournament brand”.
With a third of FIFA’s own sponsors and suppliers having no Domain-based Message Authentication, Reporting, and Conformance record on their mail domains, Hogue-Spears said, cybercriminals don’t even need to forge anything to spoof them.
“The hard part is not knowing what to do,” said Hogue-Spears, “it is counting how many places have to do it.”
Which is where that “mobile security stress test” quote I mentioned at the start of this article comes back into the equation.
The World Cup leads to spikes in roaming traffic and dependence on mobile devices for tickets, payments, authentication and communications. This sheer volume of legitimate mobile activity “can make malicious behavior significantly harder to detect as attacks blend into normal traffic patterns,” said Kern Smith, Vice President of Global Solutions at Zimperium.
“As cybercriminals adopt a mobile-first attack strategy and use AI to scale attacks faster than security teams can manually investigate, organisations supporting global events should think beyond infrastructure resilience and adopt an edge-to-core approach to defence.”
So, while network monitoring remains critical, it has to be paired with real-time visibility into mobile devices and apps. Only this will determine whether activity represents a real incident. It will also help you understand business impact and accelerate the response before disruption spreads.
As Smith put it, events like the FIFA World Cup mean that “security becomes a speed problem as much as a visibility problem”. And let’s not forget the Olympics is coming up this summer too.
