Assessment: FIFA World Cup 2026

June 2, 2026 |by ZeroFox Intelligence

33 minute read

Executive Summary

The 2026 Fédération Internationale de Football Association (FIFA) World Cup will take place across the United States, Mexico, and Canada from June 11 to July 19, 2026. This will be the first World Cup hosted by three nations simultaneously and the first to feature 48 teams (up from 32), resulting in 104 matches across 16 cities. Millions of fans are expected to attend matches and fan zones throughout the 39-day event.¹

The unprecedented scale of the tournament presents significant logistical, physical, and cybersecurity challenges. The current geopolitical environment—including the ongoing U.S.-Israeli war with Iran, trade issues between the three hosts, domestic U.S. political tensions surrounding immigration enforcement, and Mexico’s persistent issues with cartel violence—adds layers of complexity that previous tournaments have not faced.

The recent FIFA Club World Cup (CWC) 2025 and COPA América 2024, both held in the United States at many of the same stadiums, served as a partial test run for the 2026 event and raised concerns surrounding ticketing scams, protest activity, cybersecurity threats, and the impact of U.S. immigration policies on foreign attendees. ZeroFox assesses that many of the threat vectors observed during CWC 2025 will recur at an amplified scale during the 2026 World Cup.

Tournament Details and Background

The 2026 FIFA World Cup will run from June 11 to July 19, 2026, making it the longest tournament in FIFA World Cup history.² The opening match between Mexico and South Africa will take place at Estadio Azteca in Mexico City on June 11. The United States opens its campaign on June 12 at SoFi Stadium in Los Angeles against Paraguay, while Canada begins the same day at BMO Field in Toronto against Bosnia and Herzegovina. The final will be held at MetLife Stadium in East Rutherford, New Jersey, on July 19.³

The tournament features 48 teams divided into 12 groups of four. The top two teams from each group, as well as the eight best third-place finishers, advance to a new Round of 32. The Round of 16, quarterfinals, semifinals, and final follow. The United States will host 78 of the 104 matches, including all games from the quarterfinals onward, while Canada and Mexico will each host 13 matches.⁴

The group stages run from Thursday, June 11 to Saturday, June 27, 2026, with four to six games per day. Thirty-two teams will then proceed to the Round of 32 held from June 28 to July 3, 2026, followed by the Round of 16 from July 4–7, the quarterfinals featuring eight teams on July 9 and 11, the semifinals on July 14 and 15, the runner-up match on July 18, and the final on July 19.⁵

Transportation and Accommodation

The three-country format very likely creates unprecedented logistical challenges. Fans following their teams will need to cross international borders, and inconsistencies in visa eligibility between the United States, Canada, and Mexico will likely hinder fans attending matches in multiple countries. Each host nation’s team is scheduled to play its group stage games within its own country, but knockout stage games will require cross-border travel.

The U.S. government shutdown—which ended on April 30, 2026—resulted in Transportation Security Administration (TSA) staffing shortages that will likely extend airport security screening times for World Cup arrivals.⁶ (See the Stadium Security section for a full discussion of shutdown impacts on security preparations.)
Transit fare increases have drawn criticism. A round-trip train ride from New York’s Penn Station to MetLife Stadium in New Jersey—where the World Cup final is being played—was originally priced at nearly 12 times the regular fare during the tournament before being revised downward.⁷ Boston organizers have arranged express bus service (USD 95 round trip) and prohibited tailgating at Gillette Stadium. A direct train from South Station to Foxborough costs USD 80 round trip.⁸

Accommodation shortages are likely in multiple host cities. Surge pricing for flights, hotels, and rideshare services is expected throughout the tournament. Heat-related health risks in host cities such as Houston, Dallas, and Atlanta, as well as the Mexican venues, will likely be a concern during outdoor fan zone activities in June and July.

Immigration

ZeroFox assesses that U.S. immigration policies present a significant threat to international attendance at the 2026 World Cup. The Trump administration has implemented tiered visa restrictions affecting dozens of countries, creating three distinct categories of impact for fan attendance.

Visa Suspension Category: Four participating nations face complete or near-complete visa suspensions. Haiti and Iran have total bans, while Senegal and Ivory Coast face near-total restrictions for most fans, unless they have tickets.⁹ During CWC 2025, at least 10 Egyptian, eight Tunisian, and one Saudi fan were denied visas despite holding valid match tickets, establishing a documented precedent.¹⁰
Financial Barriers: Visitors from Senegal, Tunisia, Ivory Coast, Cape Verde, and Algeria are subject to a USD 15,000 bond requirement. On May 13, 2026, the Trump administration suspended this requirement for confirmed FIFA World Cup ticket holders.¹¹ All other visitors from these countries, plus the additional 50+ nations on the restricted list, must still pay the bond.^12,13,14 This financial barrier will almost certainly deter attendance from less wealthy nations.
Immigration Enforcement Risk: The American Civil Liberties Union (ACLU)—along with over 120 organizations, including the National Association for the Advancement of Colored People (NAACP)—issued a travel advisory on April 23, 2026, warning that foreign visitors face risks of arbitrary detention, deportation, racial profiling, and device searches.¹⁵ Immigration enforcement operations are expected in host cities and near stadiums, though Immigration and Customs Enforcement (ICE) officials stated there are no plans for large-scale operations specifically targeting World Cup venues.^16,17 However, routine enforcement will likely continue.
- ICE officers operate at stadiums to counter human trafficking, sexual exploitation, and counterfeit vendor networks during events. They were also present at CWC stadiums, though no incident of note occurred. Therefore, it is unlikely that ICE will conduct specific immigration checks at World Cup stadiums.¹⁸

Stadiums

Key U.S. Locations

Atlanta, Georgia: Mercedes-Benz Stadium

Capacity of 75,000
Will host eight matches, including a semifinal
Previously hosted six CWC 2025 matches

East Rutherford, New Jersey: MetLife Stadium

Capacity of 82,500
Will host eight matches, including the World Cup Final on July 19
Has hosted nine CWC 2025 matches, including the CWC final

Miami, Florida: Hard Rock Stadium

Capacity of 65,000
Will host seven matches, including a quarterfinal and the bronze final
Site of the chaotic 2024 Copa América final crowd breach¹⁹

Dallas (Arlington), Texas: AT&T Stadium

Capacity of 94,000
Will host nine matches (the most of any venue), including a semifinal

Los Angeles (Inglewood), California: SoFi Stadium

Capacity of 70,000
Will host eight matches, including a quarterfinal
Iran is scheduled to play two group-stage games here, raising security concerns.

Seattle, Washington: Lumen Field

Capacity of 69,000
Will host six matches
Iran’s third group-stage match is scheduled here, raising security concerns.

Canadian Locations

Vancouver, British Columbia: BC Place

Capacity of 54,500
Hosting seven matches, including Canada’s second and third group-stage games
Has a retractable roof with climate control

Toronto, Canada: BMO Field (formerly known as Toronto Stadium)

Capacity of 45,500
Will host six matches, including Canada’s opening group-stage game
Capacity was expanded from 30,000 specifically for this tournament.

Mexican Locations

Mexico City: Estadio Azteca (Estadio Banorte)

Capacity of 83,000
Will host five matches, including Mexico’s opening and final group-stage games
The only venue that previously hosted World Cup matches (1970 and 1986 finals)
Will host the tournament’s opening ceremony on June 11

Guadalajara: Estadio Akron

Capacity of 48,000
Will host four group-stage matches
The stadium was in close proximity to widespread cartel violence in February 2026.²⁰

Monterrey: Estadio BBVA

Capacity of 53,000
Will host four matches

Stadium Security

Security forces across three countries are charged with protecting approximately six million fans and players at 16 stadiums and fan zones for 39 days. Around 50,000 police and security personnel are reportedly expected to be deployed, while FIFA sought more than 65,000 volunteers for logistical roles.^21,22

While the stadiums have different levels of security technology depending on the resources, they all adhere to basic security standards customary across U.S. sports venues, including X-ray scanning and clear bag policies. Some of the larger stadiums will have more cutting-edge technology, such as advanced weapons detection systems (Evolv Express) and magnetometers.²³All stadiums will require attendees to pass through metal detectors and weapons detection systems prior to entry. Bag restriction policies similar to those enforced during CWC 2025 will be in place, limiting patrons to one small bag of clutch or wallet size (around 12 inches x 6 inches x 6 inches). Prohibited items include backpacks, firearms, knives, and pepper spray.^24,25

Fan zones—large open-air venues where non-ticketed supporters can watch matches on screens—are likely of particular security concern. A FIFA Fan Festival event planned at Liberty State Park in Jersey City, New Jersey, for the duration of the tournament was cancelled and replaced with smaller gatherings, with security concerns factoring into the decision.²⁶ During Euro 2024 in Germany, fan zones accommodated 12 million tournament visitors and were identified as high-risk locations for both opportunistic crime and lone-wolf attacks.²⁷

Political Obstacles to Security Preparation

The U.S. government shutdown—which ended on April 30, 2026—created a 76-day disruption to security preparations across multiple dimensions. The shutdown's impact is led by TSA staffing deficiencies, Department of Homeland Security (DHS) funding delays, and cancelled training and surveillance programs.

TSA Staffing Shortages: A reported 1,100 TSA officers quit during the government shutdown, and their replacements will not be available by the start of the World Cup.²⁸ This staffing gap will likely extend security screening times at U.S. airports serving the tournament, creating bottlenecks for international arrivals and domestic travel to host cities. Extended screening times at airports will likely have second-order effects on ground transportation to stadiums.
Security Funding Delays: A bill authorizing USD 625 million in federal security grants for the World Cup passed in July 2025 but faced months of delays. Funds were ultimately awarded in March 2026, then delayed again by the shutdown, very likely impeding DHS's ability to process disbursements to state and local agencies.²⁹ Consequently, host cities have only recently begun conducting complex security drills testing coordinated responses to terrorist attacks, crowd crushes, cyber intrusions, and natural disasters.
Training and Surveillance Program Cancellations: DHS cancelled a program to teach law enforcement how to use drones for perimeter surveillance around stadiums.³⁰
- ZeroFox assesses that unmanned aircraft systems (UAS) represent an emerging threat vector for the 2026 World Cup. During prior high-profile U.S. sporting events, federal security agencies issued no-fly zones for drones.³¹ In 2025, an NFL playoff game was paused in Baltimore after a commercial drone was detected flying over the venue.³² While no drone incidents have resulted in kinetic attacks against spectators to date, the frequency of these incidents highlights a persistent security vulnerability.
Additionally, DHS canceled other training exercises and scaled back programs, as task force members were limited in the number of events they could attend in host cities and stadium visits for security vulnerability assessments.³³ Now that shutdown funding has been restored, DHS is likely rushing to fulfill original security obligations while canceling others, very likely meaning some preparations proceed in a rushed manner while others are deferred entirely.
- The shutdown ended four weeks before the start of the tournament. While sufficient time likely exists for critical functions (such as screening technology deployment and basic personnel training), the compressed timeline has very likely created gaps in advanced security measures (such as drone surveillance, stress-tested response protocols, and comprehensive facility vulnerability assessments).³⁴

Hooligan Violence

Authorities are likely concerned about hooligan violence that could occur outside the stadiums in fan zones or other areas for watching matches. These gathering places have been the scenes of violence in the past.

In 2018, a Liverpool supporter was left paralyzed after being attacked by rival supporters at a gathering before the match.³⁵
Hooligan violence was reported at the England-Serbia match during Euro 2024 in Germany.³⁶

Ultras, another group of hardcore fans, have carried out acts of violence during matches before and used the media attention to publicize their political stances or threatened players after games.

During episodes of political tension, Ultras have also been known to use the matches to make racist gestures. This is especially common at international soccer games, where geopolitical issues emerge.³⁷

Hooligans and Ultras will almost certainly attend World Cup matches; however, strict U.S. immigration policy will likely prevent known violent offenders from entering the United States. During the 2025 CWC, Argentina sent the United States the names of 15,000 fans banned from its stadiums,³⁸ while the United Kingdom required 150 fans under stadium bans to surrender their passports.³⁹

Ticketless Fans

ZeroFox assesses that the dichotomy between ticketed and non-ticketed fans presents elevated risks for stadium security. During the 2024 Copa América final at Hard Rock Stadium in Miami, tens of thousands of ticketless fans overwhelmed security gates and breached entry points, delaying the match by over an hour despite the deployment of more than 550 law enforcement officers.⁴⁰

During the Euro 2020 final (which was held on July 11, 2021, owing to COVID-19), thousands of England supporters without tickets overwhelmed security at Wembley Stadium, breached barriers, and accessed the event. Violent clashes between fans and stewards led to some victims being crushed.⁴¹

This likely led to overzealous policing at the next major soccer event: the Champions League final between Liverpool and Real Madrid held in Paris in May 2022. French police clashed with thousands of Liverpool supporters, whom they accused of having fake tickets, delaying the match.⁴²

Security officials for the 2026 World Cup have proposed expanding security perimeters around stadiums and placing ticket check locations further from stadium entrances to prevent unticketed fans from clustering near entry points.⁴³ While the prospect of a similar fan rush or fake ticket scandal at the World Cup is very unlikely, it cannot be ruled out.

The influx of international fans and high-profile teams very likely increases the risk of crowd surges, public order incidents, and opportunistic crime near stadiums. Attendees will be required to pass through metal detectors prior to entering the venue, with additional wait times likely.

Ticketing and Scams

Ticket prices have drawn significant criticism from fans across all three host countries. The high prices and limited availability have likely created a fertile environment for ticket scammers.

During CWC 2025, ZeroFox observed multiple unauthorized ticket-selling operations on Facebook, WhatsApp, and third-party websites such as Fanpass and Football Ticket Net.⁴⁴ Unauthorized ticket sales are very likely to recur at a much larger scale for the 2026 World Cup.

FIFA is the sole authorized seller of World Cup tickets, with tickets available exclusively through fifa[.]com. However, ZeroFox uncovered a Telegram-based trade of FIFA tickets. On April 29, 2026, Telegram user @mandy_rosez posted on the “FIFAWorldCup_Tickets” channel, offering two tickets for the upcoming FIFA World Cup 2026 New Zealand vs. Belgium match in Vancouver. The channel also features similar offers by other users.

Crime

The frequency of petty crime generally correlates with the level of tourist activity in the host city, and this pattern is anticipated to continue during the matches given the expected influx of approximately six million visitors. Increased law enforcement staffing at matches and fan zones will likely deter some criminal acts; however, the sheer geographic spread of the tournament across 16 cities in three countries will very likely stretch security resources.

Pickpocketing and related scams will very likely remain a persistent threat at stadiums, fan zones, hotels, and on public transport—particularly in areas with high tourist activity.
Public drunkenness is common at international soccer tournaments and can lead to disorderly conduct, vandalism, and physical or sexual assault. Thousands of arrests for alcohol-related offenses are typical at events of this scale. This will likely play a role in clashes between rival fans, particularly after matches.
In the United States, armed robbery and assault occur regularly in major urban areas and will likely impact visitors in entertainment zones or transit hubs. Vehicle break-ins are expected to spike in crowded fan areas. Increased law enforcement and security staffing at the matches and fan gatherings will likely result in faster-than-normal response times and deter potential criminal acts.

Mexico Cartel Violence

In Mexico, the paramount concern is likely violent crime. Host cities Guadalajara, Monterrey, and Mexico City have experienced violent activity involving extortion, kidnapping, and drug trafficking, with risks increasing after dark.

On April 21, 2026, an attacker opened fire on tourists at the Teotihuacán pyramids outside Mexico City, killing one Canadian and injuring 13 others, likely raising concerns about security around popular tourism sites in the country.¹³

However, the biggest risk likely remains common cartel-related crime. While cartels are unlikely to directly target the World Cup, their operations will likely spill over into areas frequented by tourists.⁴⁵On February 22, 2026, Mexican special forces killed “El Mencho,” the leader of Cártel de Jalisco Nueva Generación (CJNG), in Tapalpa in the central-western state of Jalisco.⁴⁶Following the operation, retaliatory acts of cartel violence followed, starting at the nearby tourist hub of Puerto Vallarta, as well as in the nearby World Cup host city of Guadalajara.

The deliberate targeting of Puerto Vallarta and Guadalajara prompted concern for the security of tourists. Both cities are approximately two hours from the special operations site and were likely targeted solely for “shock value,” which raises concern for other similar tourist hubs—especially if a counter-narcotics operation were to take place nearby.
Dozens of trucks and buses were torched (narco bloqueos) during the initial special forces operation to thwart cartel security forces. However, once the operation was complete, there were hundreds of acts of violence in parts of the country where CJNG operates.⁴⁷ Similar acts of violence are common following operations against cartel leaders to dissuade further counter-narcotics operations. Such attacks very likely aim to demonstrate cartel strength, either to security forces or rival cartels.

Mexican residents are the primary victims of cartel-related crime, and deliberate targeting of Westerners is rare. However, shootings have injured or killed innocent Western bystanders, and U.S. citizens have been the victims of kidnappings. These incidents typically prompt a U.S. Embassy travel warning that is harmful to tourism⁴⁸ and likely lead to security crackdowns. Any deliberate targeting of American interests by the cartels increases the likelihood of a U.S. military response inside Mexico against them.

Terrorism

ZeroFox has not identified any specific, credible terrorism threat targeting the 2026 World Cup. However, the geopolitical environment likely elevates the general risk of terrorism from domestic and international actors.In 2015, a group of Islamic State (IS)-trained and inspired attackers carried out a series of coordinated attacks across Paris, including outside the Stade de France in Paris during a France-Germany soccer match.⁴⁹

Since the Israel-Hamas war began in October 2023, authorities have issued several security warnings over the heightened risk of a terror attack on large gatherings. Groups such as al-Qaeda (AQ) and IS continue to use conflicts in the Middle East to increase calls for violence against Western targets. The primary concern for World Cup security planners is likely radicalized lone actors who have been indoctrinated online rather than individuals or groups who have received formal training. Mass shootings present an additional risk vector not typically faced by tournaments hosted in other countries.

In October 2023, in Brussels, Belgium, a gunman shot dead two Swedish soccer supporters ahead of a Belgium-Sweden match. The gunmen claimed to have been inspired by IS, which, at the time, called for attacks against Swedish and Danish interests over those countries' perceived tolerance of Koran burnings.^50,51

Lone-wolf attacks are difficult to identify and mitigate due to the limited circle that has knowledge of the attack planning. A lone-wolf terrorist attack would most likely involve the use of easily accessible materials, such as bladed weapons, firearms, or rudimentary Improvised Explosive Devices (IEDs). Vehicles would also likely be used as weapons to target spectators or related events that are not protected by road closures.

IS almost certainly still welcomes and encourages lone-wolf attacks in its name. Following such attacks, terrorist organizations frequently claim the attack as their own to garner additional publicity and outwardly portray their strength. Further investigations often later call into question the claimed affiliation.

Iranian-Aligned Terrorism

The ongoing U.S.-Israeli war with Iran, which began on February 28, 2026, has significantly elevated the threat environment.⁵² Iran’s national team is scheduled to play all of its group-stage games on the U.S. West Coast (two in Los Angeles, one in Seattle).

Since the conflict began on February 28, there have been incidents linked to the conflict, including the arrest of two IS-inspired men who set off homemade explosives at an anti-Islam protest in New York City⁵³ and a shooting in Austin, Texas, that followed the killing of Iran’s then-Supreme Leader Ali Khamenei on February 28.⁵⁴ On March 12, an IS supporter opened fire in a classroom at Old Dominion University in Virginia, killing one person and injuring two others.⁵⁵ In Dearborn, Michigan, a driver crashed his truck into a synagogue and its preschool and reportedly died of a self-inflicted wound during an exchange of gunfire with security personnel. The attack was allegedly in response to an Israeli airstrike in Lebanon that killed members of the driver's family.⁵⁶

There is no evidence suggesting that Iranian-aligned groups coordinated these attacks. However, it is almost certain the conflict inspired the attacks. An uptick in extremist propaganda online will likely further inspire would-be attackers, with calls for violence likely to take on added resonance.

Harakat Ashab al-Yamin al-Islamiya (Islamic Movement of the Companions of the Right Hand or HAYI), a new group mirroring some of the techniques utilized by AQ and IS-inspired attackers, emerged in March 2026 after the U.S.-Israel and Iran war began. Since then, the group has claimed 17 attacks across Europe, with the latest being a stabbing attack against two Jewish people in London, United Kingdom, on April 29. The group is reportedly linked to Iran, which allegedly recruits and pays individuals online to carry out attacks against Jewish or Israeli targets in Europe.⁵⁷

The group likely adopts tactics utilized by AQ and IS, including the use of radicalized lone actors. Elements of their operational model are also likely copied from incidents of Russian sabotage across Europe, where would-be attackers are allegedly recruited and paid anonymously online to carry out attacks. A spate of HAYI-claimed arson attacks against London synagogues appear to be modeled on Russia-aligned attacks against supporters of Ukraine.⁵⁸
- On the opening day of the 2024 Paris Olympics, extremist groups orchestrated coordinated arson attacks on railway infrastructure in France, delaying 800,000 passengers. Russian sabotage was initially suspected, although some also blamed environmental extremists for the attacks.⁵⁹
- Extremists groups likely pose a risk to U.S. critical infrastructure during the tournament. World Cup transportation infrastructure likely remains particularly vulnerable.

The activity attributed to HAYI is very likely repeatable across other regions of the world, and the operational model allows the sponsors to maintain plausible deniability. This also risks a further shift in global public opinion against Iran. If an attack were to occur during the World Cup with credible evidence linking it to Iran, there would very likely be a U.S. military response that risks re-igniting the conflict in Iran.

Boycott and Protest Activity

Geopolitical and Anti-War Protests

ZeroFox assesses that the U.S.-Israeli war with Iran is the most significant source of potential protest activity for the 2026 World Cup. Iran’s scheduled group-stage matches in Los Angeles and Seattle are very likely to draw both pro-Iranian and pro-U.S./Israel demonstrations, particularly if the ceasefire collapses before or during the tournament.

U.S. President Donald Trump has offered mixed messages regarding the safety of Iran’s team⁶⁰ and has suggested Italy should replace Iran in the tournament. Subsequently, Iran asked FIFA to relocate its matches to Mexico, but the request was denied.⁶¹ However, Mexico did agree to host the Iranian team after U.S. authorities refused to let the players stay overnight, meaning the team will travel to the United States and leave at the end of each match day.⁶²
If the U.S. and Iran teams advance beyond the group stages, there is a roughly even chance they meet in the following round, which would very likely exacerbate political and security tensions.
Anti-war protests have already been a feature of U.S. public life since the Israel-Hamas war began in October 2023, and the expansion of the conflict to Iran has likely intensified these movements.

Pro-Palestinian protests targeting major events have been documented throughout 2023–2025, including during the Macy’s Thanksgiving Day Parade, the Grammy Awards, and the Eurovision Song Contest.⁶³ZeroFox did not observe any evidence of a coordinated effort to disrupt the 2026 World Cup, but activist groups will likely use the tournament’s global visibility to stage demonstrations. While unlikely, FIFA could look to coordinate protest zones away from stadiums as seen at recent Olympic games. More likely, security will necessitate that protests be held a reasonable distance away from stadiums.

Since President Trump enacted tariffs in April 2025, many Canadians and Mexicans have boycotted American products. The World Cup coincides with the July 1, 2026, deadline to renegotiate the United States-Mexico-Canada (USMCA) free trade agreement. President Trump has considered exiting USMCA and imposing additional tariffs on Canadian and Mexican goods,⁶⁴an action that would almost certainly deteriorate relations between the three nations.

Mexico

The powerful Coordinadora Nacional de Trabajadores de la Educación (CNTE) teachers' union has threatened a national strike during the tournament to protest pay and working conditions.⁶⁵ While Mexico has shortened the national school year to end on June 5 to avoid clashing with the event,⁶⁶ the CNTE likely remains a battle-hardened group capable of staging disruptive protests for weeks. In the recent past, its actions have caused significant supply chain and transportation disruptions.

Although no specific dates have been announced for the strike, there is a roughly even chance of a disruptive protest event, as the CNTE likely views the World Cup as an opportune moment to highlight its concerns.

U.S. Political Protests and Boycotts

Nationwide protest movements opposing the Trump administration, including the Hands Off protests and the 50501 movement, have remained active throughout 2025 and into 2026. These groups have organized events across all 50 states with millions of participants. During CWC 2025, protesters planned a “No Kings” event on June 14, the start of CWC, to coincide with a military parade in Washington, D.C. Similar opportunistic protest activity around World Cup matches is likely, especially after No Kings announced another nationwide protest for June 14, 2026, to coincide with President Trump’s 80th birthday, with the biggest ones planned for New York and Los Angeles.^67,68 Five matches will be played on June 14, including one each in Philadelphia, Houston, and Dallas, where No Kings events are likely.

Both U.S. and foreign political dignitaries are very likely to attend matches, including the opening and closing games in the United States. These are very likely to prompt some form of political protest.
There is a roughly even chance that some of the anti-Trump protest groups will use the World Cup to promote their causes. Their tactics typically include peaceful marches, rallies, general strikes, and some instances of civil disobedience, such as traffic obstruction. They often take place in major urban centers, requiring security teams to monitor multiple locations and prepare for large crowds.

Across Europe, there have been calls by several prominent politicians and media figures urging citizens to boycott the World Cup, particularly over practices used by ICE and against the wider Trump administration. Additionally, 20 European soccer federations discussed boycotting the tournament over U.S. policy in Greenland.^69,70

Dutch TV personality Teun van de Keuken urged citizens to back a petition calling on the Netherlands to boycott the event.⁷¹ In January 2026, popular UK television personality Piers Morgan called for a boycott over U.S. tariffs.⁷² In January 2026, German politician Jürgen Hardt said in an interview that Germany should withdraw from the World Cup over concerns centered on U.S. politics, security issues for visitors, and backlash over ticket prices.⁷³

Despite calls from media figures and online petitions, no major European or international team has officially withdrawn, as of May 2026.

The Trump administration’s immigration enforcement policies have become a central concern for FIFA and international attendees, with visitors and residents likely concerned over the threat of aggressive immigration enforcement during matches.

In April 2026, thousands of workers at SoFi stadium in Los Angeles threatened to go on strike over working conditions and the presence of ICE at games.⁷⁴

Incidents that attract media attention, such as ICE operations in Minnesota, have the potential to harm sponsor reputations and lead to further boycott calls. In addition to happening on a bigger stage during the World Cup, any issue that occurs would also very likely be widely covered by international media, exacerbating and politicizing any response.

Anti-FIFA and Economic Protests

CWC 2025 saw significant anti-FIFA protest activity primarily centered on accusations that FIFA was prioritizing revenue generation over player safety. These protests mainly focused on the scheduling of a large, new tournament during what is generally considered the players' offseason.⁷⁵ Although the World Cup is also held during this offseason period, it is a historic tournament, and those same criticisms against FIFA are unlikely to materialize. However, protests that blend criticism of FIFA revenue generation with political or economic issues are likely.

Protests in Mexico City against rising rents and displacement caused by World Cup-related development were documented in February 2026.⁷⁶ Fan anger over ticket prices may also contribute to protest activity. Transit fare increases near tournament venues in multiple cities have very likely further fueled public discontent.

Cybersecurity Threats

Cybercriminals will likely increase counterfeiting of World Cup-related goods and clothes and the use of e-commerce and social media platforms to sell fake goods.

Criminals will likely impersonate FIFA officials to launch targeted malware or phishing attacks on organizations affiliated with the tournament. In anticipation of the event, potential cyber incidents affecting critical infrastructure and World Cup organizing bodies are likely generating significant interest from threat actors.

On May 27, 2026, the U.S. Federal Bureau of Investigation (FBI) issued a Public Service Announcement (PSA) concerning threat actors spoofing FIFA websites with the aim of stealing sensitive information, including names, email addresses, phone numbers, home addresses, and banking information.⁷⁷ Threat actors are likely engaging in this activity to collect personal information, sell fake World Cup tickets and hospitality products, and facilitate other malicious activity.

On April 20, 2026, threat actor “MDGhost” announced on the English-language dark web forum Breached that they had successfully exfiltrated internal data of Royal Moroccan Football Federation. The data exfiltrated allegedly includes personally identifiable information (PII) such as IDs, passports, photographs, contact details, licensing records, and FIFA IDs.⁷⁸

On March 12, 2026, threat actor “t2m3g” posted on the dark web forum ReHub, advertising the sale of unauthorized Remote Desktop Protocol (RDP) and cloud console access allegedly associated with New York FIFA servers.⁷⁹ The actor did not specify a price, likely indicating they want interested users to contact them privately. ZeroFox noted two users have already demonstrated interest in this offer.

ZeroFox identified 29 recently uploaded logs containing fifa[.]com email addresses currently listed for sale on Russian Market. The email addresses still available for purchase were uploaded between May 26, 2024, and May 11, 2026. The email addresses are partially obfuscated, with the full information revealed only after purchase. However, while part of the users’ information on these email addresses is hidden, ZeroFox assesses that FIFA can likely identify most of them, as the first four and last three characters of each email address are visible.⁸⁰ Additionally, ZeroFox assesses these botnet logs were very likely derived from FIFA employees’ infected work or personal computers and phones.

These email credentials do not necessarily give malicious actors unauthorized access to these corporate email accounts. Some of these email addresses were almost certainly used by FIFA employees to sign up on third-party websites, but there is a possibility these employees use the same email and password combination to access FIFA assets.

Similarly, ZeroFox identified 88 compromised credentials associated with the official @fifa[.]com email domain by investigating leaked data from private threat-actor operated log repositories between July 1, 2025, and May 15, 2026. For the same period, ZeroFox extracted more than 379,360 compromised logins to various fifa[.]com infrastructure/subdomains, including volunteer and employee logins.⁸¹

These incidents demonstrate a persistent pattern of threat actors actively targeting FIFA infrastructure. Recent intelligence continues to show elevated interest in World Cup-related systems.

On July 17, 2025, ZeroFox identified a single exposed record associated with a compromised Simple Mail Transfer Protocol (SMTP) server relevant to FIFA. The smtp.fifa[.]org login was made publicly available on the English-language dark web forum Xforum by administrator “X Forum Bot”. ZeroFox assesses that the record was exfiltrated from infostealing malware logs, infecting victim machines and comprising compromised URL, login, and plaintext password combinations.⁸²

X Forum Bot publishes hundreds of thousands of similar data sets, filtered by various entities, in an automated manner. This is likely done to promote their service in the form of free drops.

Additionally, ZeroFox noted that, on February, 8, 2026, X Forum Bot shared a previously reported data set containing over one million 2018 FIFA World Cup attendee records. This demonstrates that threat actors very likely actively seek out previously leaked event data to target current attendees with phishing and spam campaigns, sometimes years after the original breach.

State-Aligned Cyber Threats

The U.S.-Israeli war with Iran introduces a dimension of state-aligned cyber risk that was not present during previous tournaments. Iran-aligned cyber actors have historically conducted retaliatory operations against Western infrastructure following kinetic military operations.

Throughout the U.S.-Israeli war with Iran, ZeroFox has observed coordinated cyber operations targeting government infrastructure and private sector entities across the Middle East—predominantly targeting Israel—and the United States. These activities appear to be driven primarily by pro-Iranian, pro-Palestinian, pro-Israeli, anti-Iranian, and pro-Russian hacktivist collectives that have employed a combination of distributed denial-of-service (DDoS) attacks, website defacement, data exfiltration, and claimed intrusions into Industrial Control Systems (ICS).

“Handala Hack Team,” the most prominent cyber threat collective observed to date during the Iran conflict, leverages pro-Iranian hacktivism against Western and pro-Western aligned entities—several times in direct retaliation for U.S. and Israeli military action. The collective reportedly seeks to undermine U.S. military action and press releases, target and expose members of militaries/federal governments, and disrupt critical and governmental infrastructure.

According to a U.S. Department of Justice (DOJ) release, Handala Hack Team is considered one of several personas used by a hacking unit within Iran’s Ministry of Intelligence and Security (MOIS)’s psychological operations.⁸³
Handala Hack Team is very likely a state-sponsored hacktivist collective that will continue to target U.S. critical infrastructure, especially with retaliatory attacks amid ongoing geopolitical tensions.

Several other state-aligned hacktivist collectives have claimed retaliatory attacks against entities in the United States in recent weeks. The following list is not exhaustive:

In a series of posts on its Telegram channel on May 3 and May 4, 2026, pro-Iranian threat collective "Ababil of Minab" claimed to have breached and sabotaged the internal networks of Tri-Rail, South Florida's primary commuter rail system, after warning that the group would target U.S. critical infrastructure in retaliation for alleged "hostile aggression" and a "naval blockade" against Iran.⁸⁴
In April 2026, in a post on its Telegram channel, pro-Iranian threat collective “313 Team” claimed responsibility for DDoS attacks targeting the following domains: ebay[.]com, yelp[.]com, expedia[.]com, vrbo[.]com, hotels[.]com, and travelocity[.]com.^85,86
On March 30, 2026, in another post on its Telegram channel, Ababil of Minab claimed to have compromised the Los Angeles County Metropolitan Transportation Authority (LA Metro); the group allegedly breached LA Metro's systems, exfiltrated over 1 TB of sensitive user data, and subsequently executed a destructive attack by wiping more than 500 TB of data from the agency's infrastructure.⁸⁷

Potential impacts on the 2026 World Cup include DDoS attacks on tournament-related digital services, ransomware targeting tournament infrastructure such as hospitality or transportation providers, credential harvesting campaigns, and disinformation operations.⁸⁸ The 2024 Paris Olympics was targeted by multiple cyber operations,⁸⁹ and ZeroFox assesses the 2026 World Cup faces a comparable or elevated risk, given the current geopolitical environment.

Pro-Iranian-aligned threat collectives—especially Handala Hack Team and Ababil of Minab, which have demonstrated persistent targeting of transportation entities and other critical infrastructure—are very likely to continue targeting U.S.-based critical and digital infrastructure. There is a roughly even chance that threat collectives view the FIFA World Cup as an opportunity to apply political pressure and spread ideological messaging by targeting World Cup-adjacent industries, such as transportation, hospitality, financial services, and media/entertainment.

Recommendations

Avoid tickets sold through Telegram channels (such as “FIFAWorldCup_Tickets”), Facebook Marketplace, WhatsApp, and third-party sites such as Fanpass and Football Ticket Net. ZeroFox has identified active ticket scam operations on these platforms. Only purchase World Cup tickets through fifa[.]com and authorized resellers.
Expect multiple security perimeters around stadiums, with extended wait times due to TSA staffing shortages (1,100 officers reportedly quit during the recent government shutdown). Plan to arrive three to four hours before matches. Road closures in host cities are almost certain.
Book accommodations immediately. Surge pricing is expected, and accommodation shortages are likely in multiple host cities. Fans traveling to Mexico should also prepare for extended visa processing delays, which have been a documented issue for foreign attendees.
Avoid gathering in fan zones late into the evening. Hooligan violence is a documented threat at international soccer events.
Foreign visitors, particularly from Africa and the Middle East, should verify visa eligibility well in advance. Fans from Haiti and Iran face complete visa suspensions. Fans from Senegal and Ivory Coast, while facing expanded restrictions, have exemptions if they hold tournament tickets. Have documentation readily accessible if requested by authorities.
Exercise increased caution in Mexico host cities (Guadalajara, Monterrey, Mexico City), particularly after dark. Recent cartel violence includes coordinated violence in tourist areas (Puerto Vallarta and Guadalajara). While direct targeting of World Cup attendees is unlikely, violent crime remains elevated in these regions.
Enable multi-factor authentication on all accounts immediately. ZeroFox has identified credential harvesting campaigns and phishing emails targeting World Cup attendees. Threat actors are actively distributing older FIFA attendee data to target current attendees with scam campaigns. Verify URLs carefully, as impostors pose significant risk.
Be alert to unsolicited emails and messages. State-aligned threat actors (Iranian-linked Handala Hack Team, 313 Team, and pro-Palestinian collectives) are known to conduct credential harvesting and phishing campaigns tied to geopolitical events. Any messages claiming to be from FIFA or event organizers should be independently verified.
Monitor official FIFA channels and Embassy travel advisories for real-time updates. The ongoing U.S.-Israeli war with Iran elevates terrorism risk and is expected to drive protest activity, particularly near venues where Iran is scheduled to play (Los Angeles and Seattle). Conditions may change rapidly.
If not attending matches, consider deferring non-essential travel to World Cup host cities for the duration of the tournament due to elevated security risks, road closures, and surge pricing. Critical infrastructure remains vulnerable to state-aligned cyber threats targeting transportation systems.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 10:00 AM (EDT) on June 1, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

ZeroFox Intelligence Probability Scale

All ZeroFox intelligence products leverage probabilistic assessment language in analytic judgments. Qualitative statements used in these judgments refer to associated probability ranges, which state the likelihood of occurrence of an event or development. Ranges are used to avoid a false impression of accuracy. This scale is a standard that aligns with how readers should interpret such terms.

hXXps://www.fifa[.]com/en/tournaments/mens/worldcup/canadamexicousa2026
hXXps://en.wikipedia[.]org/wiki/2026_FIFA_World_Cup
hXXps://www.fifa[.]com/en/tournaments/mens/worldcup/canadamexicousa2026/scores-fixtures
hXXps://www.nbcsports[.]com/soccer/news/2026-world-cup-schedule-confirmed-dates-times-stadiums-full-details
hXXps://www.fifa[.]com/en/tournaments/mens/worldcup/canadamexicousa2026/articles/match-schedule-fixtures-esults-teams-stadiums
hXXps://time[.]com/article/2026/05/01/dhs-shutdown-tsa-air-travel-impact-staffing/
hXXps://www.aljazeera[.]com/sports/2026/4/22/five-major-issues-affecting-the-fifa-world-cup-with-50-days-to-go
hXXps://www.mbta[.]com/guides/world-cup-guide
hXXps://www.cfr[.]org/articles/the-u-s-is-co-hosting-the-world-cup-but-much-of-the-world-cant-attend
hXXps://newlinesmag[.]com/argument/what-happens-to-the-world-cup-when-the-world-cant-attend/
hXXps://forumtogether[.]org/article/explainer-impact-of-travel-and-immigration-restrictions-on-the-2026-fifa-mens-world-cup/
hXXps://www.espn[.]com/soccer/story/_/id/48760094/2026-world-cup-visa-bonds-tickets-fans-trump-administration
hXXps://www.nytimes[.]com/athletic/7138400/2026/03/25/world-cup-fifa-senegal-bonds-algeria-visa/
hXXps://travel.state[.]gov/content/travel/en/News/visas-news/immigrant-visa-processing-updates-for-nationalities-at-high-risk-of-public-benefits-usage
hXXps://naacp[.]org/articles/naacp-joins-growing-coalition-over-120-organizations-issue-travel-advisory-2026-fifa-world
hXXps://www.nytimes[.]com/athletic/7038337/2026/02/11/world-cup-usa-ice-security/
hXXps://www.bloomberg[.]com/news/articles/2026-05-12/world-cup-2026-faces-trump-drama-ice-fears-ahead-of-fifa-tournament
hXXps://www.nytimes[.]com/athletic/6651989/2025/09/23/fifa-human-rights-concerns/ h
XXps://www.espn[.]com/soccer/story/_/id/44717633/copa-america-final-fan-chaos-security-miami-argentina-colombia
ZeroFox Intelligence Flash Report: Mexico Insecurity Heightened Ahead of World Cup, February 24, 2026
hXXps://healix[.]com/international/insights/blog/security-challenges-2026-fifa-world-cup
hXXps://www.latimes[.]com/sports/soccer/story/2025-08-11/want-to-attend-2026-world-cup-games-for-free-fifa-needs-65000-volunteers
hXXps://evolv[.]com/resources/press-releases/evolv-technology-helps-mercedes-benz-stadium-fans-stay-safe/
hXXps://www.nytimes[.]com/athletic/7273489/2026/05/12/world-cup-stadium-code-of-conduct-prohibited-items/
hXXps://www.fifa[.]com/en/tournaments/mens/club-world-cup/usa-2025/stadiums/bag-policy
hXXps://www.aljazeera[.]com/sports/2026/3/20/fifa-world-cup-2026-security-concerns-grow-in-us-as-funding-stalls
ZeroFox Intelligence Assessment: UEFA Euro 2024 Tournament, June 13, 2024
hXXps://time[.]com/article/2026/05/01/dhs-shutdown-tsa-air-travel-impact-staffing/
hXXps://www.aljazeera[.]com/sports/2026/3/20/fifa-world-cup-2026-security-concerns-grow-in-us-as-funding-stalls
hXXps://www.bloomberg[.]com/news/articles/2026-05-12/world-cup-2026-faces-trump-drama-ice-fears-ahead-of-fifa-tournament
hXXps://www.faa[.]gov/newsroom/faa-and-fbi-announce-strict-no-drone-zones-super-bowl-lx
hXXps://www.cbsnews[.]com/baltimore/news/baltimore-sentenced-drone-m-t-bank-stadium-ravens-playoff-game/
hXXps://www.bloomberg[.]com/news/articles/2026-05-12/world-cup-2026-faces-trump-drama-ice-fears-ahead-of-fifa-tournament
hXXps://rsdi[.]ae/en/publications/securing-the-2026-fifa-world-cup-risks-realities-and-mitigation-in-a-tricontinental-mega-event
hXXps://www.telegraph[.]co[.]uk/football/2019/02/28/roma-hooligan-attacked-liverpool-fan-sean-cox-jailed-three-and/
hXXps://www.telegraph[.]co[.]uk/news/2024/06/28/six-england-fans-get-banning-orders-after-euro-2024-attack/
hXXps://www.euronews[.]com/2019/11/09/racism-in-football-are-italy-s-ultras-the-problem-or-the-solutiony
hXXps://www.espn[.]com/soccer/story/_/id/45115536/15000-argentine-fans-banned-club-world-cup
hXXps://www.nytimes[.]com/athletic/6249295/2025/04/02/chelsea-manchester-city-fans-club-world-cup/
hXXps://www.espn[.]com/soccer/story/_/id/44717633/copa-america-final-fan-chaos-security-miami-argentina-colombia
hXXps://news[.]sky[.]com/story/euro-2020-final-fans-could-have-been-killed-after-mindless-thugs-stormed-wembley-report-finds-12485182
hXXps://news[.]sky[.]com/story/liverpool-fans-compensated-over-chaos-at-2022-champions-league-final-in-paris-13100320
hXXps://www.wusf[.]org/politics-issues/2025-05-21/new-florida-law-targets-unruly-fan-behavior-at-sporting-events
ZeroFox Intelligence Assessment: FIFA Club World Cup 2025, June 10, 2025
hXXps://ackermangroup[.]com/special-security-assessment-fifa-world-cup-2026/
hXXps://www.reuters[.]com/world/americas/new-us-military-led-group-aided-mexicos-hunt-el-mencho-cartel-boss-2026-02-22/
hXXps://app.dataint[.]mx/es/public/map
hXXps://mx.usembassy[.]gov/security-alert-update-4-ongoing-security-operations-u-s-mission-mexico-february-23-2026/
hXXps://www.bbc[.]com/news/av/world-europe-34814891
hXXps://time[.]com/6303348/quran-burning-sweden-denmark/
hXXps://apnews[.]com/article/sweden-quran-desecration-attack-belgium-0b2b52e448823377d9ed42493960faf6
hXXps://ackermangroup[.]com/special-security-assessment-fifa-world-cup-2026/
hXXps://www.justice[.]gov/opa/pr/two-isis-supporters-charged-attempting-detonate-explosive-devices-during-protests-outside
hXXps://www.fbi[.]gov/contact-us/field-offices/sanantonio/news/fbi-provides-investigative-update-on-march-1-austin-shooting
hXXps://www.pbs[.]org/newshour/nation/rotc-students-at-old-dominion-university-killed-shooter-who-left-1-dead-2-wounded
hXXps://michiganadvance[.]com/2026/03/30/fbi-says-michigan-synagogue-attack-was-inspired-by-hezbollah/
ZeroFox Intelligence Flash Report: Pro-Iran Terrorism in Europe – SITREP #36: May 5, 2026
hXXps://www.bbc[.]com/news/articles/c04g5x1wq5vo
hXXps://www.bbc[.]com/news/articles/c28eyr3y18yo
hXXps://www.espn[.]com/soccer/story/_/id/48184550/us-president-trump-iran-skip-world-cup-safety
hXXps://www.usatoday[.]com/story/sports/soccer/worldcup/2026/04/13/iran-world-cup-games-mexico-request-rejected/89589194007/
hXXps://www.nbcnews[.]com/world/iran/mexico-host-irans-world-cup-team-us-refusal-president-says-rcna346803
ZeroFox Intelligence Assessment: Physical and Cyber Threats to Olympic Games Paris 2024, July 17, 2024
hXXps://www.csis[.]org/analysis/usmca-review-2026-six-scenarios-north-americas-future
hXXps://www.record[.]com[.]mx/historia/mundial-2026-en-riesgo-de-protestas-cnte-amenaza-con-movilizaciones-por-falta-de-acuerdos-2026051616253872388
hXXps://www.moroccoworldnews[.]com/2026/05/302170/mexico-teachers-threaten-strike-during-2026-world-cup/
hXXps://www.mobilize[.]us/nokings/
hXXps://www.nokings[.]org/
hXXps://www.facebook[.]com/groups/1889847931554290/
hXXps://www.theguardian[.]com/football/2026/jan/29/world-cup-boycott
hXXps://enas[.]com/soccer/another-call-to-boycott-the-2026-world-cup-over-trump-f202601-n/
hXXps://www.express[.]co[.]uk/sport/football/2160369/piers-morgan-donald-trump-england-world-cup
hXXps://www.givemesport[.]com/countries-boycotted-world-cup-football-soccer/
hXXps://www.nytimes[.]com/athletic/7317374/2026/05/29/sofi-stadium-strike-world-cup/
ZeroFox Intelligence Assessment: FIFA Club World Cup 2025, June 10, 2025
hXXps://www.aljazeera[.]com/sports/2026/4/22/five-major-issues-affecting-the-fifa-world-cup-with-50-days-to-go
hXXps://www.ic3[.]gov/PSA/2026/PSA260527
ZeroFox Intelligence
ZeroFox Intelligence
ZeroFox Intelligence
ZeroFox Intelligence
ZeroFox Intelligence
hXXps://www.reuters[.]com/technology/iran-linked-hackers-restore-website-after-us-seizes-domains-2026-03-20/
ZeroFox Intelligence Needle: Cyber Operations Driven by U.S./Israeli-Iran Tensions #28
ZeroFox Intelligence Needle: Cyber Operations Driven by U.S./Israeli-Iran Tensions #27
ZeroFox Intelligence Needle: Cyber Operations Driven by U.S./Israeli-Iran Tensions #26
ZeroFox Intelligence Needle: Cyber Operations Driven by U.S./Israeli-Iran Tensions #23
hXXps://paladinsecurity[.]com/security-prevention/2026-world-cup-security-risk-north-america/
ZeroFox Intelligence Assessment: Physical and Cyber Threats to Olympic Games Paris 2024, August 17, 2024

ZeroFox Intelligence

Tags: Threat Intelligence