MalwareTips: fake American Airlines 'account information changed' emails lead to AAdvantage login phish on nolix.cyou
In a post dated October 24, 2026, MalwareTips warns about an email impersonating American Airlines that claims the recipient's account information has changed without saying what changed. MalwareTips says the reported…
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
In a post dated October 24, 2026, MalwareTips warns about an email impersonating American Airlines that claims the recipient's account information has changed without saying what changed. MalwareTips says the reported message's account-review and service-center links both lead to a counterfeit AAdvantage sign-in page associated with nolix[.]cyou, which asks for an AAdvantage number or username and password. It notes the reported footer contains a mismatched loyalty-program (MileagePlus) reference, that American Airlines is impersonated rather than the operator, and that the original destination could not be captured for the article. MalwareTips advises checking the account only through the airline's app or by typing aa.com, and changing the password through the airline if credentials were entered on the fake page.
How the scam works
The email claims that personal details on the account were updated but holds back what changed 'for security reasons'. That leaves the reader with a problem they can't judge from the message itself, so clicking 'review account' seems like the obvious next step. Both the account-review and service-centre links lead to the counterfeit AAdvantage sign-in page. With an AAdvantage number or username and password, criminals can take over the account, redeem or transfer miles, change bookings, or reuse the password on other services.
The footer's MileagePlus reference, which is United Airlines' programme rather than American's, is a sign the message was assembled from copied templates. MalwareTips couldn't capture the original destination. If you entered your details, change your password through the airline's app or aa.com and check your recent activity and miles balance. Also change the password anywhere else you used it. American Airlines is impersonated and is not involved.
Source
MalwareTips, "American Airlines Account Changed Email Scam: Fake AAdvantage Login Trap" (published 24 October 2026).
Red flags
- An email saying your account information has changed without saying what.
- Links that lead to a sign-in page on a domain such as nolix.cyou instead of aa.com.
- A footer that mentions another airline's loyalty programme, such as MileagePlus.
- Requests for your AAdvantage number and password from an email link.
If you were targeted
- 1Don't use the links in the email; open the American Airlines app or type aa.com yourself.
- 2If you entered your details, change your AAdvantage password through the airline straight away.
- 3Check your account activity and miles balance for changes.
- 4Change the password on any other account where you used it.
- 5Report the email as phishing to your email provider.