The 2026 World Cup is well and truly underway. Each of the hosts made impressive displays as they kicked off the competition, though the jury’s still out on some of the revamped rules and whether hydration breaks impact the flow of matches.

FIFA projects an attendance of approximately 6.5 million spectators across the expanded 48-team tournament, but the reality of prohibitive expenses and visa-related anxieties suggests a potentially diminished physical presence. But that won’t stop billions of viewers from remaining transfixed by the games on screens all over the world.

Soccer (football)’s premium continental contest offers lucrative riches for brands and players, but it’s also an event of such magnitude that the underlying infrastructure needs to be equally, if not more, formidable.

While network upgrades across the host nations will keep fans connected, the quadrennial showcase represents a mammoth undertaking of unprecedented scale when it comes to security, with threat actors and scammers licking their lips with anticipation to take advantage of the event.

Open goal for cybercriminals

The World Cup is up there in terms of sporting significance with the Super Bowl, Ryder Cup, and Wimbledon. But generally speaking, sports are a tantalizing target for threat actors.

To put things in perspective, ahead of the World Cup, a Darktrace report revealled 57% of professional sports organizations experienced multiple cyber incidents in the last 12 months.

And while contemporary industries are facing rising pressure to cope with AI-infused attacks, the vendor found that 83% of cybersecurity professionals working in professional sports believe they have detected AI use in cyberattacks against them in the past 12 months. Just shy of three-quarters (72%), meanwhile, believe AI will increase cyber risk over the next year.

Darktrace’s report suggests the average cyber incident has cost sports organizations around $169,000 over the past 12 months. But with the World Cup underway, the folks in the soccer space, that number could rise dramatically.

“Professional sport is a high-pressure environment where timing matters,” said Nathaniel Jones, VP of security and AI strategy at Darktrace. “A suspicious login, unusual data movement, or unexpected AI agent action may look small in isolation, but during a live event, it can become operationally significant very quickly.

“The most effective way to mitigate the risks facing sports organizations both internally and from external actors today is to adapt a behavioral approach to security. That means shifting away from rules and signatures and focusing on understanding both human and AI behavior inside your environment.”

Tickets, streams, and scams

Already, fraudulent activity centered around the World Cup has emerged, with Chinese-origin threat actors attempting to dupe unsuspecting fans hoping to grab a last-minute ticket.

Unearthed by CloudSEK’s Threat Intelligence team, the actors were using cloned FIFA ticketing websites to track payment card details. The fraudulent ticketing portals were realistic down to the ticket prices, with identical branding and payment processes to those of a legitimate FIFA platform. However, the fraudsters were able to track and capture PANs, expiry dates, and CVVs of fans who unwittingly filled out their payment details.

According to CloudSEK, the operation was vast, with some 40 fake sites uncovered as part of a vast rogue payment processing network. The firm found that a multi-tenant fraud infrastructure hosted through a Chinese-language administrative backend was supporting at least 15 operator instances, indicating that the campaign is not a single phishing site but a scalable reseller-style cybercrime operation.

The Bengaluru, India-based security firm found that target traffic was primarily through social media in-app browsers, with Facebook accounting for approximately 60-65% of observed sessions and Instagram contributing around 15%.

Victim footprint varied, with fans targeted from the U.S. and Canada, as well as South Africa, Sweden, and Hong Kong.

“This campaign shows how major global events are being weaponised by organised cybercriminal groups. The threat is no longer limited to fake ticket listings or basic phishing pages. We are now seeing full checkout impersonation, live victim tracking, card skimming, and OTP interception capabilities being combined into one operational platform,” said Gagan Aggarwal, a threat intelligence researcher at CloudSEK Triad.

That Chinese-linked operation is one of a veritable smorgasbord of attempts to dupe fans.

Since January 2026, Arctic Wolf catalogued more than 10,000 new World Cup-themed domains, registering at a rate of roughly 2,000 per month. While the majority are not likely malicious, the compounding factor was the sheer volume of sites being produced with generative AI, with the tech creating the websites, content and even the apps behind them.

Tracking closely with CloudSEK's finding on Facebook/Instagram in-app browsers driving traffic to fake ticketing sites, Arctic Wolf found the dominant attack surface was the mobile device. Its research revealed lures that typically appear as deceptively clean posts on social media that funnel victims into WhatsApp, Telegram, or Discord, where the actual fraud or malware delivery happens away from platform moderation.

Those social media-led lures largely offered users promises of free streaming links a few minutes before match kickoffs, banking on excited fans clicking through without checking the link.

When the hosts become the hunted

But it’s not just fans that are the targets, with even the organizers under threat.

Arctic Wolf identified a weaponized “Employee Handbook” PDF targeting staff at a U.S. host city (Philadelphia), which uses a malicious QR code to redirect victims on mobile devices to credential-harvesting infrastructure.

That was joined by a cluster of fake “FIFA careers” sites built to steal corporate Google Workspace accounts. Arctic Wolf even uncovered a real-time adversary-in-the-middle phishing kit, hosted across roughly ten fake "FIFA hiring" domains, that logs into a victim's real Google account live, intercepts the one-time multi-factor authentication (MFA) code as it's issued, and replays it to Google within seconds. Such a sophisticated approach means standard OTP, SMS, and push-based MFA provide no protection.

The vendor called on defenders to adopt phishing-resistant authentication immediately, treat QR codes and ‘do not forward’ pressure as inherently hostile. It also called for staff protecting the event to hunt the domain clusters and share indicators across host cities.

“We believe that the generic delivery patterns we observed almost certainly point to parallel campaigns we have not yet seen,” Arctic Wolf’s report reads.

“The World Cup is about to put billions of people, devices, and transactions online at once – across ticketing, payments, broadcast, stadium operations, and host-city infrastructure,” said Dave Russell, SVP and head of product strategy at Veeam Software. “The scale of the attack surface is unprecedented: temporary tournament networks layered onto existing environments, a vast ecosystem of suppliers and partners, and countless dependencies that create real opportunities for disruption.

“What’s critical to recognize is that this will be the first World Cup in the agentic era, where the actor is no longer only human. AI agents can initiate actions, move data, change configurations, and trigger workflows at machine speed. That changes the risk model: trust can’t be based on intent or assumptions – it has to be based on verification, governance, and recoverability; continuously.”

“In this reality, resilience isn’t optional – it’s the foundation,” Russell added. “Global events don’t just test prevention; they test whether organizations can sustain trust under extreme and highly visible pressure. And while AI can strengthen detection and response, it also accelerates impersonation, phishing, and disruption, meaning speed and scale now apply to attackers and defenders alike.”