On August 10, 2026, Delta Air Lines Flight 591 (Las Vegas → Atlanta) carried passengers leaving DEF CON 34. Crew ACARS messages and later reporting describe an unauthorized network named “Delta WiFi Fast.” Delta says the SSID was not its own, cabin Wi-Fi was turned off for about 30 minutes, and flight safety and aircraft operating systems were not affected. FBI Atlanta told Ars Technica it is aware of the reports.
This is the same class of evil-twin / deauth phishing we covered for hotel Wi-Fi DNS hijacks — except the hotspot sat in a pressurized cabin, not a lobby. It is not a duplicate of that hotel campaign.
MERENA’s consumer “This Week” digest flagged the Delta advisory alongside older Instagram and Steam leads. We deep-dive Flight 591 because it is the newest named U.S. incident and is not already a News post.
Snapshot
| Field | Detail |
|---|---|
| Flight | Delta 591, LAS–ATL, Aug 10, 2026 (Boeing 757; 199 pax / 6 crew) |
| Alleged lure | Rogue SSID Delta WiFi Fast after Wi-Fi deauth / jamming reports |
| What Delta confirmed | Unauthorized Wi-Fi present; not Delta-operated; safety not in question |
| What remains unverified | Who ran the SSID; whether credentials were actually stolen |
| Credential rumor | Frequent-flyer reports of a page collecting personal + Google logins |
How an in-flight evil twin works
| Step | What passengers see |
|---|---|
| 1. Deauth | Forged management frames knock devices off the real cabin AP (PMF helps; many captive portals still don’t) |
| 2. Twin SSID | A lookalike name (Delta WiFi Fast) appears stronger or “faster” |
| 3. Captive page | Browser opens a login that looks like airline Wi-Fi or Google |
| 4. Harvest | Typed passwords, cookies, or session tokens leave the cabin on the attacker’s radio |
Delta has not confirmed the phishing page. Treat that layer as passenger/social reporting until the airline or FBI says otherwise.
SkyMiles vs Google MFA (YubiKey and Google Authenticator)
Public docs only — not a logged-in mystery shop. Same grades as our MFA directory.
| Grade | Meaning |
|---|---|
| Fail | Documented second factor is SMS, voice, or email OTP (or app push with no open TOTP / FIDO) |
| Partial | Better than SMS, but no standard TOTP and no YubiKey/FIDO |
| Pass (TOTP) | Self-serve Google Authenticator / Proton Pass-style OATH TOTP |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Portal | YubiKey / FIDO | Google Auth / TOTP | Grade |
|---|---|---|---|
| Delta SkyMiles (docs) | No | No | Fail |
| Google Account (docs) | Yes | Yes | Strong |
Delta’s three advertised methods are Fly Delta app notification, text OTP, and email OTP. That is Fail under our SIM-swap / inbox-OTP rule. App push without open TOTP is not Pass.
If the cabin lure really asked for Google logins, phishing-resistant Google MFA (security keys / passkeys) is the control that matters. SMS or email codes typed into a fake portal still lose.
Independent cybersecurity audits
EmailMeNow domain audits on August 14, 2026. 100% is the ideal overall score — none of these reach it. Scores are public identity / transport / website posture. They do not prove who ran the cabin SSID.
| Organization | Domain | Overall | Identity | Transport | Website |
|---|---|---|---|---|---|
| DEF CON | defcon.org | 79% | 60% | 100% | 100% |
| Viasat (IFE / cabin connectivity peer) | viasat.com | 77% | 90% | 15% | 68% |
| Delta Air Lines | delta.com | 70% | 90% | 15% | 43% |
google.com | 52% | 50% | 70% | 45% |
Audit links: defcon.org · viasat.com · delta.com · google.com
Pattern: delta.com and viasat.com both sit at 15% Transport (MTA-STS / related) — the same mail-path gap as many travel brands. google.com at 52% overall is 48 points under ideal; spoofed “Google Wi-Fi login” mail and lookalike hosts remain useful after a cabin harvest. June 2026 airline listicle had delta.com at 70% overall / 45% website; this refresh holds overall and shows website 43%.
Website stack note
Passive website-tech probes on August 14, 2026 (--deep --fresh):
| Domain | Stack |
|---|---|
delta.com | No notable CMS / PHP / short-horizon TLS flags |
google.com | TLS via Google Trust Services; expiry 2026-10-08 (~54 days at probe) |
defcon.org | TLS via HARICA; expiry 2027-03-03 |
No outdated WordPress/Drupal versions were exposed. These are point-in-time public signals — not an exploit path for in-flight Wi-Fi.
Blacklist / deliverability
Mail/domain DNSBL probes August 14, 2026 (public DoH). Shared-MX / UCE L2–L3 hits are low-signal — do not read as “org blacklisted.”
| Domain | Mail/domain status | Note |
|---|---|---|
delta.com | Clear | Web/CDN SPFBL on apex only (not primary) |
google.com | Listed (low-signal) | SPFBL on shared smtp.google.com MX |
defcon.org | Listed (low-signal) | UCEPROTECT L2 on mail-*.datamerica.com |
Spamhaus ZEN/DBL/ZRD were unavailable via public resolvers — verify on check.spamhaus.org before claiming clean/listed there.
Cybersquat / lookalikes
--registered-only scans August 14, 2026. delta.com used the BEC profile.
| Brand | Checked | To review | BEC staging |
|---|---|---|---|
delta.com | 117 | 85 | 2 — del-ta.com, drelta.com (NS+MX) |
google.com | 102 | 78 | 2 — googl3.com, googlw.com (NS+MX) |
defcon.org | 104 | 23 | 1 — defcon.cloud (NS+MX) |
High-noise Google/Delta lookalike space (delta-support.com, login-google.com, www-google.com) is useful for post-flight “your Wi-Fi login failed — reset here” mail. Track with Cybersquat Domain Monitoring.
CourtListener
Texas federal RECAP (txsd txed txnd txwd) and a nationwide keyword search found no docket for Flight 591, DEF CON 34, or in-flight Wi-Fi spoofing as of August 14, 2026.
A separate WDTX civil case, Tii v. Delta Air Lines, Inc., 1:26-cv-01595, filed June 12, 2026, is not tied to this incident in public docket metadata.
What travelers should do
| Do | Don’t |
|---|---|
| Use a full-tunnel VPN before any Google / Microsoft / banking login in the air | Join “faster” lookalike SSIDs |
| Prefer YubiKey / passkeys on Google; never type codes into a captive portal | Approve MFA prompts you didn’t start |
| Turn cabin Wi-Fi off if the crew disables the official network | Assume “Delta” in the SSID means the airline |
| Enable SkyMiles MFA anyway — then push Delta for TOTP / FIDO | Reuse SkyMiles passwords on Google |
Same VPN rule as hotel Wi-Fi Microsoft 365 hijacks.
Related coverage
- Hotel Wi-Fi DNS hijack / Microsoft 365
- Major U.S. airlines email-security audits
- MFA directory — YubiKey, TOTP, passkeys
- IBM Cost of a Data Breach 2026
Protect your organization.
Run a free Instant Cybersecurity Audit at audit.emailmenow.com — and contact EmailMeNow IT Consulting for travel MFA, DMARC, and full-tunnel VPN baselines aimed at the 100% ideal.
Sources: BleepingComputer — Delta probes Wi-Fi deauth (Aug 11, 2026) · Ars Technica · CyberScoop · FOX 5 Atlanta · MERENA Security Alerts (consumer digest lead) · Delta SkyMiles MFA help · Google security keys / 2-Step Verification. Independent EmailMeNow audits, website-tech, blacklist, and cybersquat probes August 14, 2026. Domain scores: audit.emailmenow.com only. Phishing-page details are passenger-side unless Delta or FBI confirms.