"Criminals exploit this urgency by offering discounted tickets, fake hospitality packages, and time-sensitive deals that push fans to act quickly," says Yuan Huang, Global Fraud Intelligence Lead at
@GroupIB.
Cybercriminals follow attention the same way marketers do because attention creates opportunity, says Santiago Pontiroli (
@spontiroli), Lead TRU Researcher at
@Acronis.
The Group-IB investigation found that more than 4,300 fraudulent domains have been registered since August 2025. Group-IB researchers found that:
➤ The operation had effectively recreated FIFA's digital experience, building what investigators describe as a near-perfect clone of FIFA's official website and its PingIdentity single sign-on authentication process
➤ Fraudsters aggressively weaponized Facebook advertising to direct users toward fraudulent ticketing experiences, pairing artificially low prices with urgency-driven messaging
➤ Counterfeit merchandise storefronts targeted football fans across Latin America. Fraudulent travel services preyed on international visitors. Fake streaming platforms promised access to matches while secretly infecting devices with remote access malware
➤ Behind the scenes, infostealer malware families such as Vidar and Lumma harvested credentials that were later traded on underground markets.