# Large-Scale Scam and Impersonation Campaign Targeting Commercial Airline Industry (11,600+ Malicious Domains, 35+ Brands)

> BforeAI PreCrime Labs identified 1,799 suspicious domains registered between September-December 2025 (part of a broader 11,600+ domain dataset) impersonating 35+ global airline brands, deploying phishing booking portals, fake mobile apps, cryptocurrency/meme-coin fraud, fake job/vendor portals, fake support portals, gambling sites, and FIFA World Cup 2026 ticket lures to harvest credentials, PII, and payment data from travelers and airline employees.

- **Published:** 2026-02-24T00:00:00Z
- **Last reviewed:** 2026-02-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1524
- **ID:** TL-2026-1524
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between September and December 2025, BforeAI's PreCrime Labs tracked 1,799 suspicious domains directly impersonating 35+ global commercial airline brands -- including LATAM, Avianca, British Airways, EasyJet, United Airlines, Qatar Airways, Ryanair, Lufthansa, AirAsia, IndiGo, Qantas, Batik Air, and Etihad -- as part of a much larger dataset of 11,600+ domains abusing the airline industry across all fraud categories. Roughly 10,000 of those domains used generic travel keywords ("airline", "flight", "charter", "airfare", "private jet") rather than a specific brand name, producing broad, non-targeted phishing infrastructure that casts a wider net than brand-specific attacks and exceeds prior-year totals observed across the entire online travel agency (OTA) industry.

The campaign spans multiple abuse categories operating concurrently: (1) booking-portal and check-in-page phishing that mimics legitimate airline UX to harvest payment card data and PII; (2) loyalty-program and rewards-account phishing using keywords such as "points", "miles", "rewards", and "cards"; (3) cryptocurrency and meme-coin fraud, including fake branded tokens (AirIndiaCoin, IndigoCoin) and fraudulent crypto payment options for flight bookings, several of which were opportunistically spun up around viral industry news (e.g., the Ryanair-vs-SpaceX-CEO public dispute); (4) fake job/recruitment and vendor-onboarding portals using "hiring", "career", "employee", and "partner" language, some password-protected to appear legitimate, soliciting resumes and identity documents from prospective airline employees and contractors; (5) fake customer-support portals stood up during real service disruptions (e.g., IndiGo's flight-cancellation crisis) requesting booking references and payment details under time pressure; (6) gambling/betting sites abusing airline branding and VIP/bonus language (e.g., "WinAirlines Casino" targeting Italian-speaking users, AirAsia betting-themed domains); (7) fake mobile applications distributing malware under airline branding, including Qatar Airways-themed apps used for credential harvesting; (8) AI/LLM-buzzword exploitation, with at least 36 domains combining airline branding with generative-AI flight-search claims; and (9) FIFA World Cup 2026-themed ticket and travel-bundle scams exploiting fan urgency around the tournament, consistent with a broader wave of 13,000+ World Cup-themed domain registrations (roughly 9% malicious/suspicious) tracked industry-wide, including the "Ghost Stadium" cluster of 300+ FIFA-login phishing pages and Android malware families (BTMOB RAT, Massiv, Perseus banking trojans) distributed via fake World Cup streaming/ticketing apps that overlap thematically with the airline-impersonation infrastructure.

BforeAI recorded 400+ domains specifically targeting the high-transaction-value private-jet/charter segment (e.g., privatejetsupport[.]com, charterbookingportal[.]net) and noted a marked acceleration in operational tempo: whereas domain registrations tied to major airline disruptions previously took days to surface, 2026-era threat actors are launching supporting phishing infrastructure within hours of a public incident, timed to align with peak media coverage for higher victim-conversion rates. Newer, higher-cost TLDs (.vip, .luxury, .gold, .app, .live, .shop) are disproportionately used for premium-fraud themes (private aviation, crypto, VIP loyalty), while generic-keyword phishing favors low-cost legacy TLDs (.com, .net, .org). The dataset was produced with a reported false-positive rate below 0.05%, indicating high-confidence detections rather than broad keyword sweeps. No CVE, malware family unique to the airline campaign itself, or specific named threat actor/APT group has been publicly attributed by BforeAI; the activity is characterized as a mix of opportunistic cybercriminal fraud rings and campaign-style, infrastructure-reuse operations rather than a single coordinated actor.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1593 Search Open Websites/Domains
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1584 Compromise Infrastructure
- T1608 Stage Capabilities
- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1036 Masquerading
- T1684.001 Impersonation
- T1610 Deploy Container
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1213 Data from Information Repositories
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1090 Proxy
- T1657 Financial Theft
- T1660 Phishing
- T1430 Location Tracking
- T1636 Protected User Data
- T1663 Remote Access Software
- T1512 Video Capture

## Sources

- [Commercial Airline Industry Sees Sustained Scam and Impersonation Activity in 2026](https://bfore.ai/report/commercial-airline-industry-scam-impersonation-activity-2026/)
- [Airline brands become launchpads for phishing, crypto fraud](https://www.helpnetsecurity.com/2026/02/25/airline-phishing-campaigns-crypto-fraud/)
- [BforeAI Highlights Rising Airline-Focused Cyber Threat Activity](https://www.tipranks.com/news/private-companies/bforeai-highlights-rising-airline-focused-cyber-threat-activity)
- [Cybercriminals create 19,000 FIFA-themed domains ahead of 2026 World Cup](https://www.helpnetsecurity.com/2026/06/08/fifa-world-cup-cyber-threats/)
- [World Cup 2026: how to avoid ticket scams and fake sites](https://proton.me/blog/world-cup-2026-scams-phishing)
- [FBI warns of fake FIFA World Cup 2026 ticket sites stealing fan data](https://www.foxnews.com/tech/world-cup-ticket-scams-target-desperate-fans)
- [World Cup 2026 Scams: Fake Tickets & FIFA Sites](https://scamwatchhq.com/fifa-world-cup-2026-scams-fake-tickets-streaming-fraud/)
- [Active Exploitation Alert: FIFA World Cup 2026 Targeted by Fake Ticket Sites, Banking Malware, and Credential Theft](https://www.rescana.com/post/active-exploitation-alert-fifa-world-cup-2026-targeted-by-fake-ticket-sites-banking-malware-and-credential-theft)
- [FIFA World Cup 2026 Ticket Scams: How to Spot Fake Tickets and QR Codes](https://www.kaspersky.com/resource-center/preemptive-safety/fake-world-cup-2026-tickets-qr-codes)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1524