DEF CON Attendees Allegedly Jam Plane Wi‑Fi, Launch ‘Evil Twin’ Phishing Attack

A Delta Air Lines flight returning travelers from Las Vegas reportedly became the site of a high-altitude Wi-Fi phishing incident when someone on board allegedly disrupted the aircraft’s official internet service and broadcast a fraudulent wireless network.

The incident occurred on Monday aboard Delta Flight 591, a Boeing 757 flying from Las Vegas Harry Reid International Airport to Atlanta. The flight took off shortly after the conclusion of Hacker Summer Camp, which included events such as BSides Las Vegas, Black Hat, and DEF CON 34.

DEF CON Attendees Allegedly Jam Plane Wi‑Fi

According to reports based on Aircraft Communications Addressing and Reporting System (ACARS) messages, the crew informed corporate security about the situation approximately one hour after departure.

One message indicated that a passenger had set up a “scam Wi-Fi” network named “Delta WiFi Fast” in an apparent attempt to deceive other passengers.

A subsequent transmission claimed that several passengers returning from a cybersecurity conference had “jammed” the cabin Wi-Fi service to transmit their own signal.

The term “jamming” may have been used informally by the crew; it’s unclear from the publicly available details whether actual radio-frequency jamming occurred or if devices were forcibly disconnected from the legitimate network using Wi-Fi deauthentication techniques.

Security researchers have described the situation as a potential “evil twin” attack. In such attacks, an adversary creates a rogue wireless access point that closely resembles a legitimate network.

Travelers trying to connect may unknowingly join the malicious network and encounter a fake captive portal designed to capture credentials, such as Google or email account logins.

Speculation on social media and within private aviation groups suggested that the alleged operators might have used portable wireless-auditing equipment, such as a Wi-Fi Pineapple, to disconnect nearby devices from the legitimate cabin network.

This would make the phishing network more appealing to passengers experiencing connectivity issues. However, these claims remain unverified.

According to CSN, Delta confirmed that an unauthorized Wi-Fi network was briefly active on the flight but stated that no Delta systems were compromised. The airline reportedly disabled the legitimate passenger Wi-Fi service for about 30 minutes after identifying the rogue network.

Delta spokesperson Morgan Durrant assured that flight safety was never compromised and no aircraft operating systems were affected.

The flight carried 199 passengers and six crew members, and no emergency was declared to air traffic control. Reports that federal agents or airport police met the aircraft upon arrival at Atlanta’s Gate A18 have circulated online but remain unconfirmed as the inquiry continues.

If proven true, this incident could have serious legal consequences. Deliberately interfering with authorized communications, attempting to steal credentials, or compromising an airline-operated network could fall under federal communications, fraud, identity theft, and computer misuse laws.

The alleged incident has also drawn criticism within the security community. Researchers have pointed out that DEF CON and similar events are intended to promote defensive research, responsible disclosure, and security education, not to target passengers on commercial flights.

For travelers, this incident underscores an important rule: only connect to the airline’s officially advertised Wi-Fi network, verify captive portal URLs before entering credentials, and treat unusually named “faster” networks as potential phishing traps.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world