{
  "Event": {
    "analysis": "1",
    "date": "2026-06-24",
    "extends_uuid": "",
    "info": "[Threat Intel] FIFA 2026 Security Alert: Cybercriminals Exploit Fan Excitement with Mass Phishing",
    "protected": false,
    "publish_timestamp": "1782525139",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782525139",
    "uuid": "6ca919fe-bca6-4ea5-b03c-0c3e0bcf9984",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#3000b9",
        "local": false,
        "name": "rectifyq:workflow=\"enrichment\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Cybercrime\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442806",
        "to_ids": false,
        "type": "link",
        "uuid": "a7296abd-5d66-45fd-af40-1d204612e2d4",
        "value": "https://www.pointwild.com/threat-intelligence/fifa-2026-security-alert-cybercriminals-exploit-fan-excitement-with-mass-phishing/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442806",
        "to_ids": false,
        "type": "text",
        "uuid": "165b1b9e-5924-41ec-94e6-40b563bfd2be",
        "value": "Threat actors are exploiting anticipation for the FIFA World Cup 2026 through sophisticated phishing campaigns targeting fans seeking tickets, hospitality packages, and tournament information. Attackers have deployed FIFA-themed domains and mobile-optimized phishing infrastructure resolving to specific IP addresses, designed to harvest credentials and payment information. The campaigns feature convincing fake ticketing portals that mimic official FIFA services, collecting personal details including names, emails, phone numbers, and payment card data. Some variants redirect victims to online gambling platforms after credential theft. The infrastructure leverages third-party payment services like KOIpay and EBpay, with JavaScript redirecting users to external payment gateways. Victims face risks including fraudulent account creation, credential stuffing attacks, email account takeover, and unauthorized financial access. This operation represents part of a larger fraud ecosystem targeting the tournament."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442806",
        "to_ids": false,
        "type": "text",
        "uuid": "b67824be-2906-45ce-b72b-9010ce4b93b9",
        "value": "Name: FIFA 2026 Security Alert: Cybercriminals Exploit Fan Excitement with Mass Phishing\nAuthor: AlienVault\nAdversary: \nTags: [\"payment fraud\", \"ticket fraud\", \"mobile targeting\", \"gambling redirect\", \"fifa 2026\", \"social engineering\", \"phishing campaign\", \"credential harvesting\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468832",
        "to_ids": true,
        "type": "domain",
        "uuid": "c15b5d7c-f896-45d3-9431-f5c501d72824",
        "value": "fifa-ticket-26.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442806",
        "to_ids": true,
        "type": "domain",
        "uuid": "3bb43e8b-e97c-4445-b488-7f569102f666",
        "value": "buy-ticket-fifa.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442806",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4665831a-7cf6-4c70-a202-22b690349ea4",
        "value": "m.buy-ticket-fifa.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442806",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f1a0725f-5d7b-4b2c-a812-03e3cecb5bb5",
        "value": "wap.buy-ticket-fifa.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442806",
        "to_ids": true,
        "type": "hostname",
        "uuid": "84fae898-1902-4165-aeda-02d13ed94ae3",
        "value": "www.buy-ticket-fifa.com"
      }
    ]
  }
}