Malwarebytes researchers have identified over 40 fraudulent websites masquerading as free FIFA World Cup streaming platforms to trap unsuspecting users in malicious advertising and cryptocurrency scam networks.

Key Points

• Researchers discovered more than 40 identical websites using World Cup branding to serve malicious ads instead of live match streams.
• The sites utilize scripts to force users through advertising loops, generating revenue for operators while exposing visitors to fake virus warnings and malware.
• Promoted content includes deceptive message notifications and cryptocurrency schemes promising unrealistic financial returns.
• Intel 471 reported that approximately 19,000 domains referencing FIFA have been registered since January 2026, many linked to phishing and fraud.
• Law enforcement agencies, including the FBI, have issued warnings regarding spoofed FIFA sites, fake ticket sales, and fraudulent hospitality packages.

Why it Matters

These scams highlight the significant cybersecurity risks fans face when seeking unauthorized access to high-profile sporting events. By exploiting the popularity of the World Cup, cybercriminals can effectively distribute malware and financial fraud schemes to a global audience.