FIFA World Cup 2026 Phishing Campaign Spreads Voidrift Malware Through Fake Merchandise Offers

A new FIFA World Cup 2026 phishing campaign is targeting football fans and employees with convincing emails that promise exclusive tournament merchandise. Researchers warn that the scam installs Voidrift malware, giving attackers access to corporate networks while successfully evading several leading email security platforms.

Fake FIFA Merchandise Emails Deliver Voidrift Malware

Cybersecurity researchers at Cofense Intelligence have uncovered an active phishing campaign that exploits the excitement surrounding the FIFA World Cup 2026.

The attackers send personalized emails claiming that recipients qualify for exclusive World Cup t-shirts through a special partnership between FIFA and their employer. The messages encourage victims to download a registration form to claim the merchandise.

Instead of receiving a sign-up document, victims download Voidrift malware, which installs on their device and gives attackers an initial foothold inside the organization’s network.

Once the malware is active, cybercriminals can steal business data, monitor corporate activity, and compromise sensitive company accounts.

Personalized Emails Make the Scam More Convincing

Researchers say the campaign stands out because attackers carefully personalize every phishing email.

Each message includes the recipient’s name and references the company where they work. The fake promotional t-shirts even display the employer’s logo, making the offer appear authentic and significantly increasing the chances that victims will trust the message.

According to Cofense Intelligence, this level of personalization makes the phishing campaign far more convincing than traditional mass email scams.

Attackers Bypass Major Email Security Platforms

The campaign has also proven effective against several widely deployed email protection solutions.

Researchers found that the phishing emails successfully bypassed Cisco IronPort, Microsoft ATP, and Abnormal Security, allowing malicious messages to reach users’ inboxes despite existing security controls.

Cofense Intelligence says the combination of convincing social engineering, personalized content, email gateway evasion, and the stealthy Voidrift payload makes this campaign an immediate cybersecurity concern for organizations.

Employee Awareness Remains the Best Defense

Although organizations rely heavily on automated email filtering, researchers stress that user awareness remains one of the most effective defenses against this campaign.

Employees should carefully examine unexpected promotional offers, avoid downloading unsolicited attachments, and report suspicious emails to their security teams instead of interacting with them.

World Cup 2026 Continues to Attract Cybercriminals

The latest FIFA World Cup 2026 phishing campaign is part of a broader wave of scams exploiting one of the world’s biggest sporting events.

In May, weeks before the tournament began, researchers at Group-IB uncovered six separate fraud schemes operated by four different threat groups. Their investigation also identified more than 4,300 fraudulent domains impersonating FIFA’s official online presence.

More recently, the US Department of Justice seized approximately 400 domains that illegally streamed FIFA World Cup 2026 matches.

Conclusion

The growing FIFA World Cup 2026 phishing campaign shows how quickly cybercriminals capitalize on major global events to target both consumers and businesses. By combining highly personalized phishing emails with Voidrift malware and techniques that bypass leading email security platforms, attackers have created a campaign capable of fooling even well-protected organizations. Remaining cautious with unexpected promotional emails and verifying offers through official channels remain essential during high-profile events like the World Cup.