A Delta Air Lines flight carrying passengers home from the world’s largest hacking conference became the center of a rapidly unfolding cybersecurity scare on Monday after crew members reported that someone on board had jammed the aircraft’s official Wi-Fi.
The incident occurred aboard Delta Flight 591, a Boeing 757 that departed Las Vegas Harry Reid International Airport around 8:30 a.m. on August 10, following an overnight delay, and flew roughly three and a half hours toward Atlanta.
About sixty minutes into the journey, pilots messaged corporate security via ACARS that a passenger had created a “scam Wi-Fi” network named Delta WiFi Fast.
DEF CON Attendees Accused of Hacking In-Flight Wi-Fi
A follow-up transmission stated that “a bunch of pax that were at a cyber conference in Vegas… were able to jam our Wi-Fi and broadcast their signal,” a message independently picked up by two ground-based ACARS receivers.
The flight departed shortly after DEF CON 34 concluded, as part of the annual “Hacker Summer Camp” cluster, which also includes Black Hat and BSides Las Vegas.
Security researchers describe the reported activity as a textbook evil twin attack, in which an attacker broadcasts a rogue access point whose SSID mimics a trusted network, luring users onto a fraudulent captive portal that harvests credentials.
Social media and private flyer group posts alleged that the operators used a portable auditing tool, such as a Wi-Fi Pineapple, to deauthenticate devices from the legitimate cabin network, then “jamming” the network before presenting the spoofed login page to capture Google credentials.
Delta confirmed an unauthorized network was briefly active but stated its own systems, including the in-flight Wi-Fi infrastructure, were not hacked, and that the rogue network was “not provided, operated or supplied by the airline”.
CSN stated that cabin crew disabled the legitimate passenger Wi-Fi for about thirty minutes as a precaution; no emergency was declared to air traffic control.
A Delta spokesperson said “safety of flight was never in question and no aircraft operating systems were affected,” adding the airline would “partner with federal law enforcement and aviation regulators to ensure the incident is thoroughly investigated”.
FBI Atlanta has confirmed it is looking into the incident, though no arrests have been made as of Tuesday. The FAA said it had not yet received a formal report, and Atlanta police referred inquiries to federal authorities.
Claims that agents met the plane at the gate to question passengers and seize equipment remain unconfirmed and part of the open inquiry.
Intentionally jamming aircraft wireless communications may implicate the Communications Act, while credential phishing may trigger wire fraud statutes, and impairing a network could invoke the Computer Fraud and Abuse Act.
The case echoes a 2024 Australian incident in which Michael Clapsis was sentenced to seven years for running evil-twin networks on Qantas flights and at airports.
Within infosec circles, reaction has been sharply critical, with commentators calling the alleged stunt “catastrophically stupid” and warning it undermines the credibility of researchers who attend DEF CON to strengthen not exploit aviation security.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
