A fake airline app might look like it’s been created to steal an airline login or payment details. But in one campaign recently analysed by IBM Trusteer, the end goal goes much beyond that.
In August 2026, IBM Trusteer published an analysis of a new version of GoldDigger, an Android banking Trojan capable of carrying out fraud directly on an infected device. Researchers found that the current campaign primarily impersonates airline companies, as well as shopping retailers, and has resulted in infections largely across South Africa and the UK.
When opened, the malicious app presents users with a fake login screen designed to imitate a legitimate company. But once installed and given the permissions it requests, GoldDigger can move beyond the initial airline interaction and target banking activity on the same device. IBM found that the malware can capture banking credentials, read SMS messages containing two-factor authentication codes and interact with banking apps to initiate fraudulent transactions.
For the airline being impersonated, the important part is that none of this requires the airline itself to be compromised. Its brand can be used to gain a victim’s trust at the beginning of an attack that ultimately targets their bank account.
How the fake app works
When GoldDigger is first opened, it displays a fake login page designed to imitate the interface of a legitimate company. The user is prompted to either register as a new user or enter their existing account credentials, helping the malicious app maintain the appearance of a genuine service.
The app then asks the user to enable Android’s Accessibility service. If permission is granted, GoldDigger displays a fake rewards screen while, behind the scenes, registering the infected device with its command-and-control (C&C) server. As part of this process, information about the device and the password entered on the initial login page is sent to the server.
The C&C server then sends configuration information back to the malware, including a list of banking apps to target. At this point, what appeared to be an interaction with an airline or retailer has created a pathway for GoldDigger to target financial activity elsewhere on the victim’s device.
The Permission That Gives GoldDigger Control
Android’s Accessibility service is a real feature designed to help people interact with their devices. It can give apps the ability to read content displayed on screen and perform actions such as entering text, clicking buttons and navigating between screens.
GoldDigger abuses these capabilities to interact with other apps on the infected device. IBM found that the malware can mimic user actions within targeted banking apps, allowing it to enter information, click buttons and perform gestures that can be used to initiate fraudulent transactions.
The access can also give attackers visibility into sensitive information. When a victim opens a targeted banking app, GoldDigger can capture credentials from the login screen and read SMS messages sent to the device, including two-factor authentication codes. This means a permission that initially appears to relate to the fake app can ultimately give the malware access to information and functionality well beyond the app itself.
The airline isn't necessarily the final target
The role of the impersonated airline in this campaign is particularly interesting because the organisation being imitated isn’t necessarily the ultimate target.
BEYOND THE
IMPERSONATED IDENTITY
In this case, the airline impersonation is only one part of a much broader attack. The victim may believe they’re interacting with an airline, while the malware operating behind the fake app is ultimately designed to target their financial accounts.
This creates an unusual dynamic for the organisation being impersonated. Its identity is central to establishing the initial trust, even though the eventual fraud takes place somewhere else entirely.
What this means for airlines
The GoldDigger campaign highlights a wider challenge for airlines. An organisation doesn’t need to experience a breach for its identity to be used as part of a cyberattack. Attackers can create malicious applications that imitate legitimate companies without needing access to their genuine apps, websites or internal systems.
This means securing the platforms an airline owns is only part of the picture. Organisations also need visibility into how their identity is being used across external digital environments, including mobile applications they don’t operate or control.
Identifying that activity early can help airlines investigate what sits behind an impersonating asset, understand the potential risk to customers and take action against malicious infrastructure before it causes further harm.
Detecting impersonation beyond your own platforms
Threats like GoldDigger demonstrate why external visibility matters. An organisation can secure its legitimate apps and digital platforms while malicious assets using its identity continue to operate elsewhere.
Unphish helps organisations detect impersonation and other external threats across mobile apps, domains, websites, social media and other digital channels. Detections can then be investigated to understand the activity behind them, gather supporting evidence and determine the appropriate path to enforcement.
Looking beyond an individual asset can also help identify connections between related threats, giving organisations a clearer view of the wider campaign rather than treating each detection in isolation.