Miles Away from Safety: The Frequent Flyer Fraud

This report analyzes the exploitation of airline loyalty accounts for money laundering and value extraction, detailing how threat actors source credentials from breaches and infostealer logs, automate sales via Telegram bots, and scale account takeovers with credential stuffing tools like OpenBullet. It notes underground marketplace activity and example wallet transactions, and recommends defenses including MFA on customer endpoints, shorter session lifetimes, dark web credential monitoring, and robust behavioral detection on public logins.