Brazil has more World Cup titles than anyone, five of them to be precise, but after going through five straight tournaments without adding to that count, the team is leaning hard on data this time. 

Every player wears a sensor-packed “smart vest” tracking field position (via GPS), heart rate, and a stat called “player load,” the same kind of numbers that your Whoop band or Apple Watch brags about, but tuned specifically for the sport.

So what exactly do these smart vests track?

The vests sit under the jersey, and Brazil uses them for its men’s, women’s, and youth teams. Every club sends the match or practice data back to the national team on a daily basis. 

That lets sports science chief Guilherme Passos monitor plenty of metrics including sprint speeds, fatigue, and hamstring rehab, not just for the national team, but for players scattered across continents. 

The smart vests stay on during World Cup matches as well, helping decide which player needs rest between games. Here’s the twist, and an interesting one no less. 

Passos once flagged a player covering only around 3.7 miles a match, which is about half what other teammates ran. By the numbers, he looked like a slacker. 

Why did the data almost get one of Brazil’s players benched?

But when coaches reviewed the video footage, they realized that the player, in Passos’s own words, ȧs always in the right spot, in the perfect tactical position (via BBC).

The player’s identity is a secret, for obvious reasons, but it’s the lesson that’s more important here: playing better doesn’t mean running more on the field, and the smartest player on the field can have the most boring smart vest data. 

This isn’t unique to Brazil, though. FIFA cleared GPS vest systems for official matches back in 2015. Most of the 48 teams at this World Cup are using similar setups from companies like Catapult and STATSports, the same brands behind a lot of consumer fitness gear. 

FIFA has leaned further into the data trend this year with Football AI Pro, an assistant built with Lenovo. It uses machine learning to analyze match data and feed instant insights to coaches and players. 

Instagram is expanding its AI-powered voice effects for DMs to more users, adding new filters to the feature as part of Meta’s FIFA World Cup 2026 push. The update is live on Android and iOS, though Instagram says availability is limited to select countries.

The feature first started rolling out in India in March with eight effects: Chipmunk, Demon, Alien, Robot, Underwater, Stadium, Wobble, and Fishbowl. The wider rollout now brings the total to 15, adding Goal!, Pirate, Autotune, Whisper, Grandpa, Grandma, and Princess to the mix. The Goal! effect is a new addition timed to the FIFA World Cup, and Meta says it triggers a surprise animation when sent.

How it works

To use the feature, tap the voice message button in a DM thread, then tap the new effect button that appears between the delete and send buttons in the bottom bar. First-time users will see a pop-up that reads: “Now you can transform how you sound in voice messages. Choose the perfect voice to make your conversations more memorable.”

The pop-up includes a Meta AI terms disclaimer noting that interactions will be used to improve AI at Meta. When a voice message with an effect is sent, recipients can see which effect was applied and tap on it to use the same one in their reply.

World Cup features across Meta’s apps

The voice effects expansion is part of a broader set of FIFA World Cup features Meta announced across its apps. On Facebook, the company is adding a Football Mode, tournament-themed stickers, and a Live Updates feature for Messenger group chats that surfaces real-time match highlights.

Instagram is also getting an enhanced search experience that surfaces curated tournament content, including Reels, Stories, and posts from official broadcasters and national teams.

The 2026 World Cup kicks off next week across 16 cities in the US, Mexico, and Canada. It is the largest in history: 48 teams, 104 matches, 39 days. It is also the most technologically surveilled sporting event ever staged, with robot dogs, net-shooting hunter drones, and thousands of AI-powered cameras deployed across venues and fan zones.

“It’s 78 Super Bowls over 39 days,” said Andrew Giuliani, executive director of Trump’s World Cup task force. FEMA has distributed $625 million to the 11 US host cities, with an additional $250 million earmarked for tracking and neutralising suspect drones.

Boston Dynamics’ Spot robot dogs are patrolling AT&T Stadium in Arlington, Texas, as part of a “Security Spot” initiative by owner Hyundai. The company says it is deploying “its largest and most advanced mobility fleet to date,” making it the first official partner to provide robotics for the tournament. The robots will inspect suspicious packages and hazardous materials.

Sightings of the quadrupeds sparked immediate surveillance fears. Rumours spread on social media that the dogs were scanning faces. Boston Dynamics told Chron that the robots “do not have facial recognition capabilities.” But the optics of robotic security patrols at a sporting event drew comparisons to the Black Mirror episode “Metalhead.”

Mexico is deploying four robot dogs called K9-X across its three World Cup venues. Officials told Wired the robots will intervene in fights or drunken incidents to protect officers. Technical details and the manufacturer were not disclosed.

Drones are the top concern. “If there is one threat that keeps me up at night, it is from drones,” said New York City Police Commissioner Jessica Tisch. Drones are banned over stadiums and fan zones. Counter-drone technology has become one of the fastest-growing segments in defence tech, and the FBI says it has a “full suite of options” to thwart incursions.

One of those options comes from Fortem, which claims to have signed a multimillion-dollar DHS contract for quadcopters that shoot nets at encroaching drones to trap them in midair. DHS declined to discuss the contract.

AI-generated misinformation is another concern. Officials warned that state actors could use deepfake videos to sow panic. The FBI will activate joint operations centres in each host city on match days. “If there’s a video that shows an explosion going off at a site, and it’s AI generated, we have people on the ground who can validate whether or not that’s true,” said FBI Special Agent in Charge Amit Kachhia-Patel.

In Dallas, a $120 million tech upgrade gives police body cameras with real-time translation, helping officers communicate with international visitors. Several drone detection startups are also joining federal efforts to secure the skies.

The security apparatus comes against a tense backdrop. The US-Israel war with Iran has changed the threat picture since planning began. Human rights groups have raised concerns about ICE presence at venues. And the Secret Service, in charge of protecting world leaders who attend, is understaffed by about 860 agents, according to Homeland Security Secretary Markwayne Mullin.

“We’re as prepared as we can be,” Giuliani said. The unspoken bet is that the tech will make up the difference.

TL;DR

Over 4,300 fake FIFA domains, banking malware in pirate streaming apps, and credential-harvesting phishing operations are already targeting World Cup 2026 fans ahead of the 11 June kickoff. The FBI, Group-IB, Fortinet, and Kaspersky have all published warnings.

The most oversubscribed sporting event in history is also the most phished. With more than 150 million ticket requests in the first 15 days and just six million seats across 16 cities in the US, Canada, and Mexico, the 2026 FIFA World Cup has created exactly the conditions that fraud thrives on: scarcity, urgency, and money moving fast.

Security researchers, the FBI, and multiple cybersecurity firms have published warnings in the past week describing a fraud infrastructure that is already operational, well-resourced, and scaling. The picture that emerges is not a handful of opportunistic phishing pages. It is a layered ecosystem of fake domains, banking malware, credential theft, and social media impersonation, all converging on the same window.

One operator, 300 cloned FIFA sites

The most detailed findings come from Group-IB, which tracked more than 4,300 fraudulent FIFA domains registered since August 2025. At the centre is a group it calls Ghost Stadium, a Chinese-speaking, financially motivated operation running a single phishing kit across more than 300 of those sites.

The fake is good. The page is a near-perfect copy of fifa.com, mimicking FIFA’s real single sign-on login, run by PingIdentity, down to the genuine client ID copied from the live site. It loads images directly from FIFA’s own servers, so the page looks authentic and slips past tools that flag copied assets.

The damage is in the details: the fake login also asks to reset the password. Once a victim enters credentials, the attacker locks them out of their real FIFA account and resells any tickets tied to it. Most traffic comes from Facebook ads with reused tracking codes, plus links on Telegram, WhatsApp, and in search results. Payment options include card entry, money-transfer apps like Chime and Nequi, Mexico-only processors, and a crypto option that converts card payments into cryptocurrency. That last one is a reliable tell, since FIFA’s official ticketing never accepts crypto.

13,000 domains and counting

FortiGuard Labs counted more than 13,000 World Cup-themed domains registered between January and May, roughly 8.8% of them classified as malicious or suspicious. The FBI’s public service announcement lists dozens of fake FIFA domains, from misspelled lookalikes to phony job pages, and warns more are coming.

Ticket fraud is just one piece. Group-IB also found counterfeit merchandise shops, bogus streaming sites that take a subscription fee and then install malware, and fake betting platforms that collect passport scans and selfies for identity theft. Bitdefender separately tracked FIFA lottery emails promising payouts of up to $2 million.

Group-IB estimates losses from premium and hospitality ticket fraud alone at $71 million to $474 million, with the broader campaign potentially reaching into the billions. Those are projections based on visible infrastructure, not confirmed losses.

Banking malware in streaming apps

For fans chasing free match streams, the bigger danger is on the phone. ThreatFabric observed a spike in malicious unofficial streaming apps, many posing as the popular RojaDirecta, around the recent Champions League final and expects a repeat at the World Cup on a larger scale.

Kaspersky tied those apps to two Android banking trojan families: Massiv and Perseus. Neither is distributed through Google Play, so installing one requires clicking past Android’s built-in warnings. Once installed, the malware uses accessibility tools to overlay fake bank login screens on real apps, record keystrokes, intercept one-time codes from SMS and authenticator apps, and control the screen remotely.

Perseus, built on leaked code from the older Cerberus trojan, even reads note-taking apps for saved passwords and crypto recovery phrases. The simplest red flag, according to ThreatFabric, is a streaming app requesting accessibility access. No legitimate streaming app needs it.

Social media, stolen credentials, and open Wi-Fi

Fortinet counted over 1,700 spoofed FIFA accounts, nearly 90% on Facebook and Instagram, plus a scheme using fake FIFA job ads and calendar invites to redirect applicants to a lookalike Google login. Bitdefender found more than 55 football-themed ad campaigns on Facebook and Instagram pushing counterfeit kits, fake Panini stickers, and phishing pages.

Stolen FIFA logins are already circulating. Fortinet found hundreds of thousands of user credentials, plus more than 4,600 FIFA-related URLs, in data collected by credential-stealing malware families including Vidar, LummaC2, and RedLine.

Host-city Wi-Fi is its own problem. A Kaspersky survey that drove around Mexico City, Monterrey, and Guadalajara found 10% to 12% of networks open and password-free, with the WPS pairing feature still active on nearly half. Both leave openings for rogue “evil twin” hotspots that copy a real network and quietly intercept traffic.

What to watch for

The scams leave clear tells. Buy tickets only through fifa.com, typed directly, not via an ad or search result. Enable multi-factor authentication, and treat any seller requesting cryptocurrency as a scam. On Android, refuse accessibility permissions for streaming apps. On open Wi-Fi in host cities, use mobile data for banking and email.

Meta says it is now showing warning pop-ups when people search Facebook for FIFA tickets, and it partnered with Visa to take down a Facebook network linked to fake World Cup gambling sites. The FBI is asking victims to report at IC3.

The bigger concern is what has not yet been activated. Group-IB counted roughly 3,800 fraudulent FIFA domains sitting parked and unused, ready to switch on. With ready-made scam kits and ticket-buying bots already for sale, the peak window is easy to predict: 11 June to 19 July, when searches for tickets, streams, and travel will be at their highest.