{"id":"ghost-stadium-fifa-ticket-scam-may-2026","category":"scam","status":"closed","title":"GHOST STADIUM clones FIFA ticketing sites to steal fans’ money and accounts","tldr":"Fake FIFA sites targeted World Cup fans through Facebook ads, stealing logins, personal details and payments. If you entered details, change your FIFA password and contact your payment provider. The tournament has ended; the campaign’s closure is unconfirmed.","summary":"Group-IB disclosed GHOST STADIUM on 27 May: more than 300 fraudulent domains copied FIFA’s login and ticket-purchase pages, with Facebook advertisements providing the main route to victims. The sites collected account credentials, contact information and card details, and took payments for tickets that were not delivered. More than 600 registrations were observed on one domain; the campaign’s total victim count and losses remain unconfirmed. Group-IB’s much larger financial figures were extrapolations, not verified losses. This is a scam, so there is no software patch. FIFA subsequently confirmed the tournament had ended. As of 3 November, the reviewed sources do not establish a campaign-wide shutdown, arrests, victim notification or money recovered.","action":"If you entered credentials on a fake site, change your FIFA password through fifa.com and check for unauthorised ticket transfers. If you paid, contact your bank or payment provider. Report the scam through ReportCyber; NSW residents can also contact ID Support NSW.","product":"FIFA accounts and FIFA World Cup 2026 ticket buyers","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["fifa","ghost-stadium","phishing","ticket-scam","facebook","account-theft"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"I purchased my FIFA World Cup 2026 tickets through a third-party platform or account. How will I receive my tickets?","url":"https://gpcustomersupportfwc2026.tickets.fifa.com/hc/en-gb/articles/36977264948253-16-I-purchased-my-FIFA-World-Cup-2026-tickets-through-a-third-party-platform-or-account-How-will-I-receive-my-tickets","by":"FIFA","date":"2026-07-19"},{"kind":"research","title":"The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament","url":"https://www.group-ib.com/blog/ghost-stadium-football-fraud/","by":"Group-IB","date":"2026-05-27"},{"kind":"advisory","title":"Threat Actors Spoofing FIFA Websites in Advance of the 2026 World Cup","url":"https://www.ic3.gov/PSA/2026/PSA260527","by":"FBI","date":"2026-05-27"},{"kind":"news","title":"Cyber Brief 26-06 - May 2026","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-06","by":"CERT-EU","date":"2026-06-02"},{"kind":"advisory","title":"Scam Alert: Fake FIFA World Cup 2026 websites","url":"https://www.nsw.gov.au/departments-and-agencies/id-support-nsw/learn/news/scam-alert-fake-fifa-world-cup-2026-websites","by":"ID Support NSW","date":"2026-06-03"}],"started":"2026-05-27","closed":"2026-07-19","created":"2026-11-03T21:07:21.213Z","updated":"2026-11-03T21:07:21.213Z","cve_notes":[],"timeline":[{"at":"2026-07-19","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"FIFA updated its ticketing guidance to confirm the tournament had concluded. It said it could not access or manage tickets purchased outside its official sales channels; this was not confirmation that GHOST STADIUM had been stopped.","url":"https://gpcustomersupportfwc2026.tickets.fifa.com/hc/en-gb/articles/36977264948253-16-I-purchased-my-FIFA-World-Cup-2026-tickets-through-a-third-party-platform-or-account-How-will-I-receive-my-tickets","by":"FIFA","patch":null},{"at":"2026-06-03","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"ID Support NSW issued a broader warning about fake FIFA websites collecting personal and banking details. It directed affected people to identity support and ReportCyber.","url":"https://www.nsw.gov.au/departments-and-agencies/id-support-nsw/learn/news/scam-alert-fake-fifa-world-cup-2026-websites","by":"ID Support NSW","patch":null},{"at":"2026-06-02","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"CERT-EU included GHOST STADIUM in its May cybercrime briefing, reporting the theft of credentials, personal information and payments through FIFA impersonation.","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-06","by":"CERT-EU","patch":null},{"at":"2026-05-27","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Group-IB disclosed GHOST STADIUM’s phishing and fake-ticket operation across more than 300 domains, primarily promoted through Facebook advertisements. Researchers observed more than 600 registrations on one fraudulent domain.","url":"https://www.group-ib.com/blog/ghost-stadium-football-fraud/","by":"Group-IB","patch":"na"}],"url":"https://hard.fyi/live/ghost-stadium-fifa-ticket-scam-may-2026/","json":"https://hard.fyi/api/live?id=ghost-stadium-fifa-ticket-scam-may-2026"}