THREAT OPS › Threat News › Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem
Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem
<p><img alt="FIFA 2026 Fraud" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" height="600" src="https://cyble.com/wp-content/uploads/2026/06/FIFA-2026-Fraud.webp" title="Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem 5" width="1200" /></p> <p><!-- wp:heading --></p> <h2 class="wp-block-heading">Executive Summary </h2> <p><!-- /wp:heading --></p> <p><!-- wp:paragra
MITRE ATT&CK techniques
- Acquire InfrastructureT1583
- Social Media AccountsT1586.001
- Spearphishing LinkT1566.002
- DomainsT1583.001
- Social EngineeringT1684
- Web Portal CaptureT1056.003
- Email AddressesT1589.002
- Search EnginesT1593.002
- Web ServiceT1102
- Financial TheftT1657
- Web ServicesT1583.006
- PhishingT1566
- Web ServicesT1584.006
- Social Media AccountsT1585.001
- Input CaptureT1056
- Social MediaT1593.001
- CredentialsT1589.001
- ImpersonationT1684.001
- Establish AccountsT1585
- Establish AccountsAML.T0021
- ImpersonationAML.T0073
Indicators of compromise
- fifa.comdomain
- zh-worldcuphub-fifa.comdomain
- zh-nowlive-fifa.comdomain
- cn-vpn-fifa.comdomain
- cn-setting-fifa.comdomain
- worldcup-fifa.comdomain
- play-worldcup-fifa.comdomain
- vip-worldcup-fifa.comdomain
- wc-fifa.comdomain
- cctv-maiqiu-fifa-wc.comdomain
- ssl-cn-fifa-wc.comdomain
- fifa-ticket-26.comdomain
- fifa-vip-huya.comdomain
- fifa-vip-wcplay.comdomain
- official-live-fifa.comdomain
- official-2026-fifa.comdomain
- vip-live-fifa.comdomain
- web-live-fifa.comdomain
- chn-maiqiu-fifa-worldcup.comdomain
- cctv-maiqiu-fifa.comdomain
- footballnewslive.onlinedomain
- totalsportek.onlinedomain
Original source: https://cyble.com/blog/operation-fantrap-fifa-2026-fraud-ecosystem/