What happened
Between May 2024 and July 2026, six vendors shipped World Cup-related capability across FIFA ticketing, member federation allocations, sponsor promotions, and adjacent account creation. The split: four sold automation, and two sold defeat of the bot-management controls that automation encountered.
How to read the four FIFA numbers
The four headline figures describe one operation across three stages: account creation, successful entry, and positive outcome. Successful entry appears twice because it is visible from both sides. The figures have different coverage and should not be treated as one conversion funnel.
- Accounts created: 1,373,231. Two vendors, reporting separately — 1,137,680 from Firefly and 235,551 from ConsolDes. Different tools, different accounts, so they add.
- Successful FIFA ticket entries: 710,521. The tools’ own success readouts — 652,430 from Firefly’s leaderboard and 58,091 from the ConsolDes feed. The same kind of record from two vendors, so they add.
- FIFA-confirmed entries: 9,114. A target-side view of the same entry activity. Two operators exposed FIFA-generated confirmation emails across 9,114 accounts in Gemini. It overlaps Firefly’s reported activity and is not additional volume to add.
- Positive FIFA outcomes: 1,740. FIFA-generated notices show 1,676 draw wins and 64 ticket issuances across 14 operators.
Separately from the FIFA ticket attack, the same Firefly tooling entered co-sponsor promotions at even larger volume (3,109,672 entries) and member federation allocations at 61,390. Those figures are reported alongside the FIFA numbers, not merged into them.
How to read the evidence
Every claim is tagged with the kind of evidence behind it. Analytic and sourcing standards follow ICD 203 and ICD 206.
Six vendors supplied the capability
Each shipped a dated World Cup release. Two sold no automation at all: Ironwood and Palewater sold defeat of named commercial bot-management controls as an API, and both announced fifa.com support on the same day. A distinct case, Coalpit, targeted a US retailer rather than FIFA, using the tournament as a signup pretext because registering as an international visitor was cheaper per account — one user reported creating more than 6,000 accounts that way.
“We fully support DataDome and Akamai on fifa.com for the FIFA World Cup 26.”Ironwood, public announcement, 2025-09-10 · Actor-asserted
| Vendor | Capability sold | First dated release |
|---|---|---|
| ConsolDes | Account creation, entry loop, password reset, form checking | 2024-09-02 |
| Firefly | Account creation, draw entry, sponsor-promotion entry | 2024-09-30 |
| Ironwood | Anti-bot bypass sold for fifa.com by name | 2025-09-10 |
| Palewater | Anti-bot bypass sold for fifa.com by name | 2025-09-10 |
| Hades | Account creation, browser and request based | 2025-11-03 |
| Coalpit | Retail account creation using the World Cup as a signup pretext | 2026-07-07 |
Most of the work went into scale
Resource development and execution accounted for 55% of the FIFA operator activity we classified, using a taxonomy that follows the structure of MITRE ATT&CK. The campaign's difficulty sat in supply and throughput more than in exploiting the target application — one vendor, Lakebottom, ran a feed recording mailbox provisioning at the scale every account-creation module required.
- Resource DevelopmentVESAL-TA004275
- ExecutionVESAL-TA000261
- Initial AccessVESAL-TA000122
- CollectionVESAL-TA000921
- Defense EvasionVESAL-TA000518
- DiscoveryVESAL-TA000717
- ImpactVESAL-TA004010
- ReconnaissanceVESAL-TA004310
- Credential AccessVESAL-TA00068
- PersistenceVESAL-TA00034
- Lateral MovementVESAL-TA00081
Capability arrived 21 months early
The first dated World Cup 26 release shipped in September 2024, 21 months before the tournament. Modules for the 2028 Olympics, the 2027 Rugby World Cup, and the US Masters shipped before the FIFA campaign even ended.
- 2024-09-02 · ConsolDesFIFA pre-register module released.
- 2024-09-30 · FireflyWorld Cup 2026 sweepstakes module released.
- 2024-12-10 · ConsolDes2026 entry module released; 2025 entry module fixed.
- 2025-08-25 · Fireflyfifa.com account generator released.
- 2025-09-10 · Ironwood · PalewaterBoth announce anti-bot bypass support for fifa.com.
- 2025-09-13 · FireflyCo-sponsor F presale entry module released.
- 2025-09 → 10First observed presale acceptances in operator inboxes.
- 2025-11-03 · HadesBrowser-based account generator released with Akamai handling.
- 2025-11-07 · FireflySponsor module released with 97 entry routes on one promotion.
- 2025-11First observed draw selections in operator inboxes.
- 2025-12-15 · FireflyThird draw-phase entry module released.
- 2025-12-20 · Firefly2028 Olympics entry module released.
- 2026-03-11 · ConsolDes2027 Rugby World Cup registration module released.
- 2026-06-09 · FireflyUS Masters account generator released.
- 2026-06-23 · ConsolDesFIFA register-form checker released.
- 2026-06-26 · PalewaterFIFA service restored after a bot-management ban wave.
- 2026-07-07 · ConsolDesFinal observed account-creation announcement.
- 2026-07-20Final observed ticket-delivery confirmation.
Co-sponsor promotions drew four times the FIFA volume
The FIFA ticket draw is the story, but it is not where most of the automated volume went. The same Firefly tooling entered co-sponsor World Cup promotions at 3,109,672 entries, more than four times its FIFA-ticketing volume, and operators won those too. Four operators holding FIFA draw-win notices also received winner notices from co-sponsor promotions — the clearest sign that one operator population moved fluidly across both. A separate route targeted a European member federation's allocation, inventory that never passes through FIFA's ticketing domain.
| Module | Target class | Downloads | Successful entries |
|---|---|---|---|
| Co-sponsor A World Cup 2026 Sweepstakes | Co-sponsor | 80 | 1,455,778 |
| Co-sponsor B FIFA 2025 Sweepstakes | Co-sponsor | 41 | 815,777 |
| Co-sponsor C FIFA WC Sweepstakes | Co-sponsor | 65 | 783,489 |
| FIFA World Cup 2026 Entry | FIFA ticketing | 62 | 486,812 |
| FIFA Co-sponsor F 2025 Entry | FIFA ticketing | 116 | 165,618 |
| Spanish federation FIFA Entry | Member federation | 37 | 61,390 |
| Co-sponsor D FIFA 2026 Sweepstakes | Co-sponsor | 17 | 50,639 |
| Co-sponsor E FIFA KickOff Sweepstakes | Co-sponsor | 20 | 3,989 |
| Co-sponsor subtotal | 3,109,672 | ||
| FIFA ticketing subtotal | 652,430 | ||
| Member federation subtotal | 61,390 |
FIFA's own mail shows the campaign reached the draw
This evidence does not come from either automation vendor. Operators run Gemini, a separate inbox-management tool that aggregates mail across every account they control. When an operator screenshots that view to claim credit, we can read FIFA's own confirmation emails and the account counts beside them — an independent, target-side check on the vendor numbers. Fourteen operators held 1,740 FIFA notices confirming a draw win or ticket issuance. Where confirmations and wins were visible for the same operator, implied win rates were 2.6% (128 of 4,984) and 2.7% (110 of 4,130), reached independently.
| FIFA notice | Operators | Notices |
|---|---|---|
| Won the Co-sponsor F presale draw | 9 | 867 |
| Won the early ticket draw | 6 | 809 |
| Ticket issued | 1 | 64 |
| Positive FIFA outcomes | 14 distinct operators | 1,740 |
Selections and access became a market
Operators traded selections, tickets, software licences, and development work. The values below are operator statements, not measurements; each was checked against the surrounding conversation, and statements that read as joking were excluded. A service market ran alongside resale, pricing access per entry, per ticket pulled, or on revenue share.
“WANTED: Fifa developer that can pull tickets off exchange. Long term relationship. Pay per ticket pulled.”Developer forum, 2026-06-02 · Actor-asserted
| Date | Signal | Quoted value |
|---|---|---|
| 2025-09-29 | Vendor advised on the resale value of a FIFA selection | $4,500 – $5,000 |
| 2025-10-01 | Standing bid to buy selections | $1,000 each |
| 2025-12-11 | Acquisition cost and prevailing resale ask | $445 in; $2,000+ ask |
| 2025-12-12 | Asking price for a category-one final ticket | $8,600 |
| 2025-12-19 | Vendor licence resale value, from a fraud warning | $7,000 – $10,000 |
| 2026-05-29 | Two seats with hospitality | $2,000 |
Controls worked. The market adapted.
Specific controls blocked paths or sharply reduced throughput. The entry funnel is defensible — but the supporting bypass market responded within days.
| Control | Attacker-reported effect | Where |
|---|---|---|
| Social sign-in | Automated entry blocked outright; operators asked the vendor to add support. | Sponsor-promotion entry |
| Payment-instrument restriction | 500 accounts produced zero selections; operators blamed a blocked virtual-card provider. | Earlier UEFA cycle |
| Bot-management change and submission challenge | One operator reported 11 completed entries after hours of running; a bypass vendor acknowledged the ban wave and restoration work. | FIFA draw entry |
What this assessment does not prove
- We did not trace a single identifier end-to-end from account creation through resale.
- Operator-reported values are claims, not measured target loss.
- Selection represents an opportunity to purchase, not confirmed attendance.
- Only the target can establish total impact across its systems.
- Figures in this assessment exclude the FIFA Club World Cup 2025.
Claims we excluded. We rejected estimates based on aggregate sponsor prize pools, unsupported throughput extrapolations, and operator lifetime totals that could not be attributed specifically to World Cup 26.
How this assessment was assembled
This assessment was built from Vesal adversary intelligence and source evidence tied directly to World Cup 26 activity. Every published figure is traceable to supporting evidence.
We disclose what can be supported and safely attributed, and withhold details where publication would compromise sources or overstate what the evidence proves.