Airline brands face increased cyber threats, with malicious actors registering thousands of lookalike domains to conduct phishing, fraud, and impersonation targeting travelers, employees, and partners. Recent intelligence shows that between September and December 2025, nearly 1,800 suspicious domains linked to over 35 airline brands were studied, revealing a broader ecosystem of over 11,600 malicious domains engaged in diverse abuse categories.
Cybercriminals leverage high-search volume keywords related to flights and airline services, often combining multiple airline names to attract users seeking booking deals. These domains mimic official booking portals, loyalty login pages, and corporate partner websites, aiming to steal credentials, payment details, and facilitate business email compromises. In addition, many domains are used for fraud involving airline tokens, illegitimate crypto offerings, and gambling advertisements.
Experts from the security firm highlight that proactive detection methods now enable the identification and disruption of malicious infrastructure before attacks fully develop. Organized threat actors preload domains during airline disruptions, activating them later when public attention is high, which allows them to evade detection and maximize damage. The evolving tactics emphasize the need for continuous vigilance and rapid response to mitigate potential impacts on the aviation sector.
