Airline-mimicking fraud | Kaspersky official blog
Source Kaspersky Security Blog
Description
Scammers are sending emails purporting to be from major airlines/airports trying to swindle money by demanding refundable deposits.
Impact
For European organizations, this phishing campaign poses a significant financial risk, especially to companies engaged in procurement, sales, or partnerships with aviation and oil and gas sectors. The fraudulent requests for deposits can lead to direct monetary losses, potentially amounting to thousands of euros per incident. Beyond financial impact, such scams can erode trust in legitimate business communications, disrupt procurement workflows, and cause reputational damage if sensitive business processes are compromised. The absence of malware reduces the risk of system compromise but increases the challenge of detection since emails appear benign to automated filters. Organizations with extensive dealings in aviation or related industries may face increased targeting, leading to operational distractions and resource diversion to investigate and remediate incidents. The social engineering nature means that even well-secured IT environments remain vulnerable if employees are not adequately trained. This threat also underscores the importance of verifying unusual financial requests through independent channels, as failure to do so can result in significant fraud losses. Overall, the campaign can impact confidentiality minimally but threatens financial integrity and organizational trust.
Defensive guidance
1. Deploy advanced email security gateways with capabilities to detect spoofed sender addresses and analyze email header anomalies to block phishing attempts before reaching users. 2. Implement DMARC, DKIM, and SPF email authentication protocols rigorously to reduce domain spoofing risks. 3. Conduct targeted security awareness training focusing on social engineering tactics, emphasizing the identification of suspicious financial requests and verification procedures. 4. Establish clear internal policies requiring independent verification of any unsolicited financial requests, especially those involving deposits or upfront payments, through official company contacts. 5. Train finance, procurement, and sales teams to recognize red flags such as unusual sender domains, unsolicited partnership offers, and requests for refundable deposits. 6. Encourage employees to report suspicious emails promptly to the security team for analysis and response. 7. Maintain updated contact lists of legitimate partners and vendors to facilitate quick verification. 8. Use multi-factor authentication and strict access controls to limit the impact of any potential compromise resulting from social engineering. 9. Regularly review and simulate phishing scenarios to assess employee readiness and improve detection capabilities. 10. Coordinate with industry groups and law enforcement to share intelligence on emerging phishing campaigns targeting the aviation and oil and gas sectors.
Summary
This phishing threat involves a fraudulent email campaign where attackers impersonate well-known airlines and airports such as Amsterdam Schiphol, Emirates Airlines, Etihad Airways, Lufthansa, and Qatar Airways. The attackers initiate contact by sending seemingly legitimate emails from the 'procurement department' announcing a new partnership program for 2025/2026. Upon engagement, they send multiple documents like registration forms and non-disclosure agreements to build credibility, none of which contain malware or malicious links, thus evading basic email security filters. The core of the scam is a request for a 'mandatory refundable deposit'—typically several thousand dollars—claimed to secure a priority spot for partnership proposal consideration. Victims are assured the deposit will be returned once agreements are finalized. The emails often use sender addresses that superficially resemble legitimate company domains but differ upon closer inspection. Some emails display the company name in the sender field but use unrelated domains. The attackers rely purely on social engineering, targeting companies across various industries and sizes, including those in the oil and gas sector. The campaign exploits trust and business formalities to extract funds without deploying technical exploits or malware. Detection relies on scrutinizing sender addresses, verifying offers through official company contacts, and recognizing that reputable companies do not require deposits for partnership consideration. Mitigation involves deploying advanced email gateway protections that analyze sender authenticity and content, alongside focused employee training for finance, sales, and procurement teams to recognize such scams. This threat highlights the evolving sophistication of phishing attacks that bypass technical defenses by exploiting human factors.