GHOST STADIUMThreat actor
GHOST STADIUM is a Chinese-speaking, financially motivated threat actor operating a sophisticated phishing campaign across over 300 domains, utilizing a custom React-based phishing kit that closely mimics FIFA's official website and exploits the PingIdentity SSO login flow.From MISP Galaxy
Last reported 27 days ago, by CERT-EU2 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1136Create Account
“Victims who create accounts and make initial deposits find that winnings are never paid out and their deposits are stolen outright.”
- T1195Supply Chain Compromise
“…ers to target government and defence organisations in Asia and Poland, while another China-linked threat actor enacted a global supply-chain compromise leveraging Daemon Tools installers distributed from the software's legitimate site.”
- T1213.003Code Repositories
“… 19, GitHub began investigating unauthorised access to internal repositories, with TeamPCP claiming theft of roughly 4.000 private code repositories and seeking to sell the data.”
- T1219Remote Access Tools
“They hosted company laptops in the US, installed remote access tools, and helped overseas operatives pose as US-based employees, generating over 1.2 million US dollars for North Korea and affecting nearly 70 US firms.”
- T1485Data Destruction
“…ing an agreement with the threat actor, the group reportedly returned the data to Instructure, and received digital confirmation of data destruction.”
- T1505.003Web Shell
“UAT-8616 exploited Cisco Catalyst SD-WAN vulnerabilities to gain admin access and deploy web shells”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Brief 26-06 - May 2026“…May 27, Group-IB reported a large-scale fraud ecosystem abusing the 2026 FIFA World Cup, including the Chinese-speaking threat actor GHOST STADIUM running a coordinated phishing and fake ticket operation.”
-
The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament“The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament”
Indicators in its reports
named in the reports above- fifa-tickets[.]vipin 1 report
- fifa[.]orgin 1 report
- hxxps://www.fifa[.]com/authin 1 report
- www-fifa.com[.]coin 1 report
- pay.zfxupi[.]netin 1 report
- fifa[.]taxin 1 report
- fifa[.]partyin 1 report
- fifa-web[.]coin 1 report
- 43.98.183[.]110in 1 report
- football-ticket[.]topin 1 report
- football-ticket[.]shopin 1 report
- football-game[.]shopin 1 report
- football-tickets[.]topin 1 report
- fifa2026tickets-streamlive[.]comin 1 report
- gname[.]comin 1 report
- testnet.chainugo[.]comin 1 report
- www.fifa[.]showin 1 report
- fifa[.]bioin 1 report
- fifa[.]centerin 1 report
- fifa[.]goldin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.