Fake ticketing portals, MFA-busting phishing kits, and weaponized employee handbooks show the tournament's attack surface extends well beyond fans