Delhi Airport Cyberattack, Clickfix Phishing-Purerat, Linkedin Targeting-Threats

Hello people!

We are back again with our fresh dose of cyber news. From crippled flight systems to vulnerability in the hospitality sector to LinkedIn becoming the new playground for threat actors, we will cover all the important cyber events that deserve your attention and time.

So, if you are all set to dive deeper into the details, scroll down! Let’s beat those malicious threat actors with your awareness and cyber proactive efforts.

Here you go!

National security agencies start probing the recent Delhi airport cybersecurity attack!

Delhi airport was recently targeted by a GPS spoofing attack. It resulted in the disruption of both domestic and international flight operations. This security incident has sparked concerns around India’s aviation safety systems. 

The NSA, or the National Security Advisor, an official who advises the PM on security matters, is now involved in the investigation of the cyber incident. The impact of the cyberattack lasted for multiple hours. It impacted some of the popular domestic carriers in India, such as Akasa Air, IndiGo, and Air India, as well as their international counterparts, such as Lufthansa and British Airways. From delayed departures and no availability around real-time flight details to missed connections, it was pure chaos and confusion for passengers. 

Delhi airport emerged from the crisis within a day, but the attack exposed a major weakness in India’s aviation infrastructure—a poor cybersecurity system.

A thorough investigation is underway, and as per preliminary findings, threat actors managed to interfere with the automated systems that manage GPS tracking and air traffic coordination. 

ClickFix phishing attacks backed by PureRAT Malware targeted at hotel systems!

A massive phishing campaign is doing the rounds, as revealed by a group of cybersecurity researchers. In this campaign, threat actors target the hospitality sector by attacking unsuspecting hotel managers and compelling them to share their credentials. 

Basically, threat actors use a compromised email account to send malicious emails to reputable hotels. The cybercrooks use spear phishing tactics and impersonate Booking.com. Next, they redirect the naive users to fake websites by using ClickFix tactics. 

The ultimate goal of the threat actors is to steal credentials so that they get access to different booking platforms like Expedia and Booking.com. The same is then either sold out on different cybercrime forums or used to send malicious emails to hotel customers to carry out fraud activities.

Researchers believe that the threat campaign has been active since April 2025. In one of the latest waves, cybercriminals sent malicious emails to multiple hotels worldwide. They try to make recipients click on malicious links that redirect them to a ClickFix page. The victims will then have to take a reCAPTCHA challenge.

Threat actors use WhatsApp or email to reach out to hotel customers with crucial hotel reservation details, which makes this campaign highly credible to the victims. They are asked to click the “confirmation” link to verify their bank card details to prevent the bookings from being cancelled.

To add to the sophistication of the attack, the ClickFix pages are becoming increasingly hi-tech and can adapt to match the display instructions for the devices used by the victims. 

Threat actors are abusing LinkedIn to target victims!

Gone are the days when phishing used to happen within email inboxes. Now, threat actors can target unsuspecting users across different platforms like search engines, messaging apps, and social media. Of late, LinkedIn is getting popular among threat actors as cybercrooks are targeting company executives with spear-phishing tactics. What’s more concerning is the fact that the majority of the phishing attacks that happen outside the email ecosystem go unreported.

But why are perpetrators choosing LinkedIn again and again to target the victims? First of all, LinkedIn DMs are a great way to go undetected by traditional security tools. Users log onto LinkedIn on work laptops and phones. This allows cybercriminals to message victims without risk of interception. Secondly, LinkedIn phishing is much easier and more accessible than email-based phishing. All it takes is creating fake accounts, adding connections, and creating fake posts and content.   

LinkedIn also allows cybercrooks to find out high-value targets easily with extensive filters and search options. Since LinkedIn is a professional networking platform, it is easier to trust the DMs even if they are from complete strangers. Lastly, LinkedIn phishing brings in massive rewards for the threat actors. They majorly target the biggies like Google and Microsoft. Getting access to such accounts opens the floodgates of data to these cybercriminals. 

So, next time you get a personalised connection request on LinkedIn, and the DM asks you to click on a link to check the job description or work brief, double-check the authenticity of the sender’s profile carefully. 

Secure your emails with SPF, DKIM, and DMARC authentication.