Chinese-speaking fraud gang could be stealing millions from 2026 World Cup fans
A Chinese-speaking fraud gang, dubbed GHOST STADIUM, is impersonating FIFA's official website to steal credentials and payment details from fans seeking tickets for the 2026 World Cup. The operation, involving over 300 fraudulent domains and a sophisticated phishing kit, poses a significant financial risk, potentially leading to billions of dollars in losses. Group-IB has identified the threat actors and advised fans to exercise caution when purchasing tickets.
The operation, spearheaded by the GHOST STADIUM group, began in November 2025 and involves the creation of over 4,300 fraudulent domains mimicking FIFA's official website. These domains are actively running fraudulent infrastructure, with approximately 3,800 more parked and ready for activation as the 2026 World Cup approaches. The group utilizes a phishing kit based on the Layui 2.7.6m open-source UI library, employing a technique to seamlessly redirect users back to the legitimate FIFA website, making the interaction appear authentic. This kit also includes a password reset parameter to immediately lock victims out of their accounts, facilitating the resale of legitimate tickets.
The fraud extends beyond simple credential theft, with some domains exclusively selling premium and hospitality-tier tickets at prices ranging from $1,500 to $10,000. Group-IB estimates that over 47,400 people have been victims of premium ticket fraud alone, with potential losses reaching between $71 million and $474 million. Considering the scale of the 2026 World Cup and the potential for broader fraud across various tiers, total losses could realistically exceed billions of dollars. The campaign is primarily distributed through Facebook advertising, offering heavily discounted tickets to pressure purchases.
Group-IB has notified relevant authorities and advises fans to exclusively purchase tickets through fifa.com, typed directly into a browser, and to be wary of any domain using a hyphenated variant of the FIFA name. The investigation, conducted from March to May 2026, highlights the sophisticated nature of this threat and the potential for widespread financial harm.