Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem
Threat Actors
Malware Families
Excerpt
Executive Summary The FIFA World Cup 2026 has become more than a global sporting event. It has evolved into a large-scale cybercrime opportunity exploited by threat actors through a coordinated ecosystem of fraudulent domains, social media channels, messaging platforms, pirated streaming services, and dark web activity. Since May 2026, Cyble Research and Intelligence Labs (CRIL) has identified nearly 4,000 domains impersonating FIFA-related brands, ticketing platforms,…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(1)
Victim
Attack Flow7 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | streameast.im | High | Score 58/100 | First seen |
| Domain | sportshub.fan | High | Score 58/100 | First seen |
| Domain | totalsportek.online | High | Score 58/100 | First seen |
| Domain | footballnewslive.online | High | Score 58/100 | First seen |
| Domain | epicsports.in | High | Score 58/100 | First seen |
| Domain | footybite.vc | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…