The cyber activity surrounding the FIFA World Cup 2026 shows how attackers prepare fraud infrastructure months before a major global event begins.

More than one-third of official tournament partners were reportedly unable to fully block email-domain impersonation, creating opportunities for attackers to send convincing messages that appear to come from sponsors, hotels, airlines, vendors, or logistics providers.

Fake sportsbook applications also increased sharply before the tournament, with coordinated developer accounts publishing applications that impersonated multiple betting brands. Fraudulent Telegram channels were also used to promote fake betting advice and direct users toward deceptive services.

Travel and hospitality companies faced similar impersonation activity. Large numbers of FIFA-themed lookalike domains were registered before kickoff, with fake hotel and travel websites designed to steal payment information, credentials, and booking details from fans under pressure to secure limited accommodation or transport.

Organizations connected to major events should monitor for lookalike domains, fake mobile applications, social-media impersonation, and unusual email activity. Strong DMARC enforcement, brand monitoring, rapid domain takedown, employee verification procedures, and customer awareness are essential.

The key lesson is that attackers do not wait for the event to start. They build websites, applications, accounts, and payment channels in advance so that the fraud appears established and credible when public interest reaches its peak.

The FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at least ten languages. Check Point Exposure Management published the FIFA World Cup 2026 Cyber Threat Report this month, covering

Source: What the Numbers Say About FIFA 2026 Cyber Risk via The Hacker News — published 30 Jun 2026.