Hackers Impersonate TAP Air Portugal in Phishing Emails Offering Canceled Flights Compensation

• Threat actors exploited high-profile events and local disruptions to enhance the believability of their phishing schemes.
• Fraudulent emails claimed to offer compensation for delayed or canceled flights due to the blackout.
• TAP Air Portugal branding added a layer of authenticity to the attack, leveraging the airline's credibility to deceive users.

Cybercriminals have once again capitalized on real-world disruptions, leveraging the widespread power outage that affected Spain and Portugal on April 28, 2025, to launch a sophisticated phishing campaign. 

Security researchers at Cofense Intelligence have revealed that malicious actors orchestrated a deceptive email campaign impersonating TAP Air Portugal, the national airline of Portugal. These fraudulent emails claimed to offer compensation for delayed or canceled flights due to the blackout.  

The phishing emails mimicked legitimate TAP Air Portugal communications, promising a refund credited directly to victims' bank accounts within two days. 

Users were directed to click a link that led to a counterfeit refund form, requesting personally identifiable information (PII) such as names, addresses, contact numbers, and banking details.  

Upon clicking the submit button on the fraudulent form, victims' sensitive information was harvested by attackers. Notably, the fake webpage displayed no confirmation of submission, leaving users unaware of the data theft.  

The campaign exhibited a multilingual approach to maximize its reach, targeting both Portuguese-speaking and Spanish-speaking individuals, with emails including subject lines like “Compensation update: delay in your recent flight” and “Compensation for your flight: Complete your request now.”

By aligning their attacks with real-world incidents like a major blackout, scammers manipulate victims' sense of urgency and trust, coaxing them into responding to fraudulent solicitations.  

Additionally, the carefully timed launch during the ongoing power outage created an environment of confusion and distraction, making recipients less likely to question the legitimacy of the emails.