Delta investigates in-flight Wi-Fi spoofing on post
A passenger on Delta flight 591 allegedly spoofed the airline's in-flight Wi-Fi with a rogue access point, prompting an FBI and FAA investigation.
Delta Airlines is investigating an incident on flight 591 from Las Vegas to Atlanta in which a passenger reportedly created a rogue Wi-Fi network named 'Delta WiFi Fast' to steal sensitive passenger data. The cabin crew deactivated the aircraft's Wi-Fi for roughly 30 minutes, and Delta says flight safety and aircraft operating systems were never affected. The FBI's Atlanta office and the FAA acknowledged awareness of the incident, which bears hallmarks of an evil twin attack involving spoofed login portals and credential harvesting. DEF CON organizers said this year's conference in Las Vegas also suffered multiple similar deauthentication Wi-Fi attacks.
- Rogue access point 'Delta WiFi Fast' impersonated Delta's in-flight Wi-Fi.
- Crew disabled aircraft Wi-Fi for about 30 minutes; no aircraft systems affected.
- FBI Atlanta and FAA are aware; investigation with federal partners is ongoing.
- Technique resembles an evil twin attack with deauthentication and credential harvesting.
- DEF CON 2026 reported similar deauthentication Wi-Fi attacks impacting operations.
Full article458 words · extracted from cyberscoop.com · click to collapse
Delta Airlines said Tuesday it’s investigating an incident on a Monday flight where a passenger reportedly used an unidentified device to spoof the airline’s in-flight Wi-Fi network, leading to severe delays and authorities to board the plane once it arrived at its destination.
Various posts on several social media networks went viral early Tuesday detailing the incident, claiming that passengers on Delta flight 591 from Las Vegas to Atlanta used an unidentified device to create a rogue Wi-Fi network that could be used to steal people’s sensitive data or personal information.
Messages from the plane’s Aircraft Communications Addressing and Reporting System (ACARS) show that the crew informed personnel on the ground that a passenger set up a network called “Delta WiFi Fast” and was “trying to scam the other passengers.”
Morgan Durrant, a Delta spokesperson, told CyberScoop that the cabin crew deactivated the aircraft’s WiFi functionality for approximately 30 minutes, the flight’s safety was never in question and no aircraft operating systems were affected.
“We are fully investigating to gather a complete set of facts, which will take time,” Durrant told CyberScoop. “We will partner with federal law enforcement and aviation regulators to ensure the incident is thoroughly investigated. We thank our crew for their professionalism and our customers for their understanding.”
The Atlanta office of the FBI, along with the Federal Aviation Administration, said it was aware of the incident, but did not provide further comment. The Transportation Security Administration referred CyberScoop to the FBI. Homeland Security Investigations did not respond to a request for comment.
The incident bears the hallmarks of an “evil twin attack,” where an attacker deploys a rogue Wi-Fi access point that masquerades as a legitimate, trusted network by cloning its name and network settings. Often paired with deauthentication attacks that forcefully disconnect devices from the real network, the fraudulent hotspot tricks nearby laptops and smartphones into automatically connecting to it instead. Once a device connects to the rogue point, an attacker can monitor unencrypted internet traffic, execute man-in-the-middle attacks, or display spoofed login portals designed to harvest sensitive user credentials and personal data.
The timing of the incident comes as the annual DEF CON cybersecurity conference concluded in Las Vegas on Sunday. The flight, originally scheduled for Sunday, did not leave Las Vegas until 8:30 a.m. Monday.
Monika Hathaway, head of press for DEF CON, told CyberScoop that Delta nor any federal authorities have reached out about the incident. However, she said this year’s conference had trouble with similar attacks.
“Our conference this year also suffered from multiple similar ‘deauthorization’ Wi-Fi attacks and it impacted some of our operations,” Hathaway told CyberScoop. “If we had caught them doing this at DEF CON we would have removed and banned them from the conference.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyberscoop.com/delta-flight-rogue-wifi-investigation-def-con-las-vegas/