Alongside challenges such as interclub rivalries, geopolitical tensions, and opportunities for all manner of physical criminal activities, the World Cup provides an expansive threat surface for hackers and scammers.

“The risk environment surrounding the 2026 World Cup is characterised by extreme operational density,” Ian Gray, VP of intelligence at threat intel firm Flashpoint, said.

“The threat is characterised by three simultaneous pressures: millions navigating shared public infrastructure, systems pushed to the brink across three countries, and a global spotlight that attracts opportunistic and malicious actors.”

According to Gray, malicious activity can be easily overlooked in places such as fraudulent ticketing domains, unauthorised gatherings, or online communities. This activity can quickly compound into operational impact.

“Effective teams should monitor both the cyber and physical domains for risk indicators to pre-empt their materialisation into real-world disruptions,” Gray said.

While Flashpoint has not observed any credible threats as of the time of writing, such threats are expected to emerge and may well already be in a planning stage. Fake domains are being spun up, vulnerable infrastructure is likely being scanned, and distributed denial-of-service (DDoS) attacks are being organised.

With that in mind, Flashpoint recommends concerned network defenders monitor online forums, watch out for the registration of fraudulent domains, and monitor key terms – such as “World Cup”, “FIFA”, “Fan Festival” – across intelligence platforms.