Booking.com Phishing Campaign Targeting Hotels and Customers

A sophisticated phishing campaign targets Booking.com hotel partners and their customers by compromising hotel administrators' systems with malware such as PureRAT. Attackers gain access to booking management accounts and use spear-phishing emails impersonating Booking.com to trick guests into paying twice for reservations. The campaign employs social engineering tactics, malicious sites, and a complex infrastructure involving compromised legitimate websites and bulletproof hosting. This operation is part of a broader cybercrime ecosystem offering specialized services to facilitate attacks on booking platforms. The threat impacts the confidentiality and financial integrity of hotel bookings and customer payments. European hospitality businesses relying on Booking.com, especially in countries with large tourism sectors, are at risk. Mitigation requires targeted security controls on hotel admin systems, user awareness training, and monitoring for unusual booking activities.

• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking MalwareMalware2026-10-21
• Active Exploitation of CVE-2026-110936 in Siemens Software CenterExploitedCampaign2026-10-20
• "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesCampaign2026-10-21
• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23