Executive Summary
On May 27, 2026, the FBI's IC3 published advisory PSA260527 — a pre-tournament warning listing 46 domains tied to FIFA World Cup 2026 fraud. The advisory covered fake ticket sellers and job posting scams. What it didn't cover was the infrastructure running behind them.
This report documents a coordinated, multi-actor operation spanning at least eight distinct threat groups, with a live adversary-in-the-middle (AiTM) backend confirmed running as of June 2, 2026, a Telegram bot exfiltrating victim credentials in real-time, and a relay chain that defeats every MFA method FIFA accounts support — including Microsoft Authenticator number-match push notifications.
The Fake Job Portal
Three of the FBI's IOC domains posed as FIFA career portals, cloning the real FIFA PinpointHQ careers platform — pixel-perfect React applications carrying the official FIFA branding:
The attack was two-stage. After submitting a job application, the site redirected victims to schedule a 30-minute interview with a fake FIFA recruiter via a cloned Calendly page — building enough legitimacy that victims trusted the next step: logging in with their real FIFA account credentials.
jobs-fifa.com — interview scheduling stage
The Live Backend: A Phishing C2 Left Unlocked
The backend powering the job portal — fifeq2026eqbackeq.onrender.com — was running openly as of June 2, 2026. The subdomain is obfuscated: fifeq2026eqbackeq decodes as fifa2026abacka — every a replaced by eq to evade keyword-based scanning. An earlier backend (fifaback2026xxx.onrender.com) had already been suspended by Render.com. The operators deployed a replacement and kept running.
FastAPI generates interactive API documentation at /docs by default. The operators left this enabled in production — the full attack schema, every endpoint, every parameter, every developer comment was publicly readable.
Endpoint map — annotated by function
"Send booking data to Telegram and store in session" — the attacker's own developer comment, left verbatim in the live production API schema. This single line confirmed Telegram as the exfiltration channel before any further probing was needed.
How the Attack Works: A Human in the Loop
This is not a credential-dumping page. It is a real-time relay system with a human operator watching a Telegram feed and making active decisions for every individual victim.
POST /api/new-user — backend generates a session_id and alerts operator via Telegram with victim IP and city.POST /api/login — victim's FIFA username and password forwarded to operator via Telegram instantly. Operator logs into real fifa.com, triggering MFA.GET /check_response every 3 seconds. Operator uses Telegram to push the required MFA prompt type to the victim's page. Victim enters the OTP — POST /api/email, /api/sms, /api/twofa, or /api/tap — forwarded to operator, who enters it into the real FIFA login. MFA defeated.redirect: "/booking". Victim fills fake ticket purchase form — card number, billing address, full PII. POST /api/booking returns: "Booking data sent to Telegram." Server holds zero persistent data.Every MFA Method Covered
The API has a dedicated endpoint for each MFA variant a FIFA account can enforce. No method is safe:
The Telegram C2: Bot Token Exposed
The backend included a diagnostic endpoint, /api/get-channel-id, that proxied calls directly to the Telegram Bot API. When called with certain parameters, the backend returned Telegram's raw error response — including the full API URL with the bot token embedded. The backend exposed the token through its own error handling — no credential cracking, no authentication bypass.
GHOST STADIUM: The Ticket Fraud Layer
The job portal AiTM operation connects to a larger ticket fraud campaign — GHOST STADIUM — running from 43.98.183.110 on Alibaba Cloud Singapore. The backend explicitly allows cross-origin requests from GHOST STADIUM domains (confirmed via CORS headers), establishing a shared operational link. GHOST STADIUM accounts for 300+ active phishing domains, an estimated 47,400 victims, and losses between $71M–$474M according to Group-IB research.
The Chinese Gambling Connection
The server hosting de-fifa.com — the German-targeted FIFA phishing domain — also hosts Chinese illegal sports betting aggregators on the same IP (38.190.234.190). The same bullet-proof infrastructure serves both criminal verticals.
The operator behind hk-fifa.com and tw-fifa.com is identifiable from Schema.org metadata embedded across both domains: 李承泽 (Li Chengze), with offices in Shenyang and Wuhan, 84 total staff, and ICP registrations 辽ICP备21077963号-2 and 鄂ICP备20066388号-1. Both domains share identical Google Search Console and Bing Webmaster verification codes, confirming single-operator control.
Ticket Resale Credential Harvesting
A separate threat actor operated fifaticket.pages.dev — a credential-harvesting FIFA ticket marketplace active since November 2025, seven months before the tournament:
Indicators of Compromise
Summary
The FIFA 2026 phishing campaign is built around a real-time human-operated AiTM platform. Victims are walked through a convincing multi-stage lure — job application, fake interview scheduling, credential login — while an operator watches a Telegram feed, logs into their real accounts, defeats MFA in real-time, and captures payment data. Nothing persists server-side. By the time a victim notices something is wrong, their credentials, OTPs, and card details are already in a private Telegram channel.
The tournament begins June 11. The infrastructure was live and issuing sessions as of June 2.
Vulnerability Assessment
Deep technical analysis of vulnerabilities affecting your infrastructure — beyond CVSS scores to real-world exploitability and impact.
Attack Surface Intelligence
Passive mapping of your external presence — every exposed service, endpoint, and piece of infrastructure visible to the public internet.
Threat Hunting
Proactive detection of compromise indicators, APT activity, and post-exploitation artifacts across your email and identity infrastructure.
Dark Web Monitoring
Continuous surveillance of stolen credential markets, threat actor forums, and data leak channels. Know when you're being targeted before it becomes an incident.
.png)
.png)
