FBI Warns of Active Spoofing Campaign Targeting 2026 FIFA World Cup Fans On May 27, 2026, the FBI issued Public Service Announcement Alert I-052726-PSA, warning of an ongoing spoofing campaign exploiting the upcoming 2026 FIFA World Cup. Threat actors are creating fraudulent websites mimicking the official FIFA platform to deceive users seeking tickets, merchandise, or employment opportunities related to the tournament. The campaign primarily aims to harvest personally identifiable information (PII), including names, addresses, email credentials, and financial data. Attackers also facilitate fraudulent transactions, such as selling fake tickets and counterfeit hospitality packages. The tactics rely on typosquatting and domain spoofing, with malicious domains using slight variations of fifa.com examples include fifa[.]pink, fifa-ticket[.]live, and wvvw-fifa[.]com. Subdomain impersonation, such as jobs-fifa[.]com, is also being used to target job seekers. The FBI expects the threat to intensify as the tournament nears, with new fraudulent domains likely appearing in search results, sponsored ads, and phishing emails. Threat intelligence firm bfore.ai has already identified 498 suspicious FIFA-themed domains, highlighting the scale of the operation. The campaign underscores the risks of brand impersonation and event-driven phishing, particularly during high-profile global events where heightened public interest can lower user vigilance. Organizations are advised to monitor newly registered domains, implement DNS filtering, and deploy threat intelligence feeds to detect emerging threats. Victims are urged to report incidents to the FBI’s Internet Crime Complaint Center (IC3).

Phishing Campaign Targets Marketing Professionals with Fake Job Offers from Major Brands A sophisticated phishing campaign is impersonating over 30 high-profile brands including Adobe, Netflix, Coca-Cola, and OpenAI to steal Google account credentials from marketing professionals under the guise of fake job interviews. The operation leverages legitimate cloud-based platforms, including PeopleForce (an HR service) and Salesforce Marketing Cloud, to lend credibility to its attacks before redirecting victims to malicious landing pages. The threat actor enhances trust by using real recruiters’ names and photos from the impersonated companies. Researcher Will Thomas of Team Cymru identified at least 34 domains mimicking brands across multiple sectors, such as airlines (American Airlines, Delta), food and beverage (Coca-Cola, PepsiCo), tech (Adobe, OpenAI), and entertainment (Netflix, FIFA). The campaign employs nested redirects, routing victims through multiple legitimate services before reaching the phishing page. For example, links in phishing emails initially resolve to exct[.]net (a Salesforce-operated domain) before redirecting to Wise Agent, a real estate CRM, and finally to the fraudulent site. The operation has been active for at least five months, initially using Outlook email addresses branded with the impersonated companies’ names. One phishing email, posing as an Adidas recruiter, invited recipients to schedule a meeting via a link that led to adidas-hiring[.]com. Victims were prompted to sign in with their Google accounts, triggering a fake Google authentication popup a browser-in-the-browser (BitB) technique that mimics a legitimate login window using HTML and CSS. While the exact method of access to the legitimate platforms remains unclear, the abuse does not indicate a compromise of PeopleForce or Salesforce. The attacker may have created genuine accounts or used stolen credentials to configure the redirect chain. A full list of the malicious domains is available in Thomas’ GitHub analysis.