{
  "name": "Threat Actors Target FIFA World Cup 2026",
  "slug": "threat-actors-target-fifa-world-cup-2026",
  "description": "A sophisticated Chinese-origin fraud operation is targeting FIFA World Cup 2026 attendees through pixel-perfect website clones and a multi-tenant phishing infrastructure. The actors deploy typosquatted domains and a commercially developed administrative system to mimic legitimate FIFA ticketing platforms. Technical analysis reveals high-fidelity brand cloning, real-time card skimming capabilities, and a distributed reseller ecosystem supporting at least 15 active operator instances. The platform functions as an active Man-in-the-Middle framework intercepting payment card details and bypassing SMS-based two-factor authentication in real time. Traffic is primarily driven through Facebook and Instagram in-app browsers. Simplified Chinese localizations and operator geolocations from IP addresses in China indicate PRC-based actors. The core payment routing hub tbpay[.]uk lacks financial regulatory authorization and has historical malicious patterns.",
  "published": "2026-06-11T14:31:35+00:00",
  "created_at": "2026-06-11T14:31:35+00:00",
  "modified_at": "2026-06-15T17:46:12+00:00",
  "created_at_opencti": "2026-06-11T14:31:35+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-06-11",
    "card skimming",
    "china origin",
    "fifa world cup 2026",
    "man-in-the-middle",
    "multi-tenant platform",
    "otp bypass",
    "payment fraud",
    "phishing",
    "typosquatting"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "216.126.233.37"
      },
      {
        "id": "",
        "name": "43.23.232.225"
      },
      {
        "id": "",
        "name": "216.126.233.30"
      },
      {
        "id": "",
        "name": "156.226.172.223"
      },
      {
        "id": "",
        "name": "27.150.251.195"
      },
      {
        "id": "",
        "name": "188.253.7.187"
      },
      {
        "id": "",
        "name": "38.60.195.137"
      },
      {
        "id": "",
        "name": "123.100.137.38"
      },
      {
        "id": "",
        "name": "222.167.244.34"
      },
      {
        "id": "",
        "name": "188.253.7.92"
      },
      {
        "id": "",
        "name": "www.fifaworldcup.one"
      },
      {
        "id": "",
        "name": "www-fifa.one"
      },
      {
        "id": "",
        "name": "www-fifa.bar"
      },
      {
        "id": "",
        "name": "www-fifa.click"
      },
      {
        "id": "",
        "name": "www-fifa.cfd"
      },
      {
        "id": "",
        "name": "www-fifa.bio"
      },
      {
        "id": "",
        "name": "www-fifa.my.id"
      },
      {
        "id": "",
        "name": "www-fifa.web.id"
      },
      {
        "id": "",
        "name": "www-fifa.club"
      },
      {
        "id": "",
        "name": "www-fifa.biz.id"
      },
      {
        "id": "",
        "name": "www-fifa.bond"
      },
      {
        "id": "",
        "name": "www.ww-fifa.com"
      },
      {
        "id": "",
        "name": "https://admin-zone.tbpay.uk/users/tenant`"
      },
      {
        "id": "",
        "name": "https://admin-zone.tbpay.uk"
      },
      {
        "id": "",
        "name": "www-fifa.cyou"
      },
      {
        "id": "",
        "name": "www-fifa.xyz"
      },
      {
        "id": "",
        "name": "www-fifa.qpon"
      },
      {
        "id": "",
        "name": "www-fifa.monster"
      },
      {
        "id": "",
        "name": "www-fifa.work"
      },
      {
        "id": "",
        "name": "https://sdf-26fifa.top/en/tournaments/mens/worldcup/canadamexicousa2026`"
      },
      {
        "id": "",
        "name": "www-fifa.info"
      },
      {
        "id": "",
        "name": "www-fifa.asia"
      },
      {
        "id": "",
        "name": "www-fifa.my"
      },
      {
        "id": "",
        "name": "www-fifa.digital"
      },
      {
        "id": "",
        "name": "www-fifa.xin"
      },
      {
        "id": "",
        "name": "www-fifa.sbs"
      },
      {
        "id": "",
        "name": "www-fifa.icu"
      },
      {
        "id": "",
        "name": "https://www.ww-fifa.com/cart`"
      },
      {
        "id": "",
        "name": "www-fifa.lol"
      }
    ],
    "attack_patterns": [
      {
        "id": "00430919-9257-403b-8a1b-958d4c3613aa",
        "name": "T1557"
      },
      {
        "id": "6babd5aa-5112-4f14-a660-60d756a65d6d",
        "name": "T1586"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "5c67e5d2-bc85-4ce0-822d-f2f5d3b0ae4e",
        "name": "T1185"
      },
      {
        "id": "c340d47a-2ea8-41ca-9a0b-a72559b89bbf",
        "name": "T1584"
      },
      {
        "id": "444de5e0-bd7f-4700-b700-26320057dd80",
        "name": "T1110"
      },
      {
        "id": "a7cb57ea-5e24-437e-8dad-1d22c2d8a80b",
        "name": "T1590.001"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "2969e5a7-1049-4df8-b1ba-8a0675de6b94",
        "name": "T1589"
      },
      {
        "id": "415f839d-5ae7-41fb-92c3-090f3226055d",
        "name": "T1586.002"
      },
      {
        "id": "28b4f0f2-bf55-4272-ad4a-d01cc899eaf8",
        "name": "T1557.001"
      },
      {
        "id": "5bab4974-1fc2-4144-b093-28ebcb8767dc",
        "name": "T1114"
      },
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "ea8c69fc-e735-4ded-8480-4c3564beace6",
        "name": "T1589.001"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "74d5f31c-5e2d-4aed-b8b9-4fabdde76dfa",
        "name": "T1598"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      },
      {
        "id": "5dee2969-7083-430e-9083-73bab54c3a18",
        "name": "T1590"
      },
      {
        "id": "e948db36-930d-4013-99ed-fdf14b65907e",
        "name": "T1589.002"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "ww-fifa.com"
      },
      {
        "id": "",
        "name": "fifa.ski"
      },
      {
        "id": "",
        "name": "fifa-online.com"
      },
      {
        "id": "",
        "name": "fifa-rbi605.p.tawkto.email"
      },
      {
        "id": "",
        "name": "fifaworldcup26.sale"
      },
      {
        "id": "",
        "name": "1346590.com"
      },
      {
        "id": "",
        "name": "fifa.gold"
      },
      {
        "id": "",
        "name": "fifa.shopping"
      },
      {
        "id": "",
        "name": "gx-fifa26.shop"
      },
      {
        "id": "",
        "name": "admin-zone.tbpay.uk"
      },
      {
        "id": "",
        "name": "fifa.center"
      },
      {
        "id": "",
        "name": "wz-fifa26.shop"
      },
      {
        "id": "",
        "name": "aa-fifa.shop"
      },
      {
        "id": "",
        "name": "site-fifa.site"
      },
      {
        "id": "",
        "name": "sdf-26fifa.top"
      }
    ]
  },
  "external_refs": [
    "https://www.cloudsek.com/blog/chinese-origin-threat-actors-target-fifa-world-cup-2026",
    "https://otx.alienvault.com/pulse/6a2ae2e76dc9f990eeb985f0"
  ]
}