Booking.com users targeted in large-scale phishing campaign, warns security firm

Security experts at Perception Point have uncovered a significant phishing campaign targeting Booking.com users. Unveiled through an advisory published on Wednesday, the sophisticated phishing scheme is executed in four methodical steps, putting the personal information of hotel guests at risk.

To kickstart their operation, cyber attackers gain unauthorized access to hotel systems, effectively taking control of the hotel’s Booking.com account. This initial breach sets the stage for their subsequent actions.

Once inside the Booking.com account, the attackers extract a treasure trove of personal data belonging to hotel guests. This includes their names, booking dates, hotel details, and partial payment methods. The potential implications of such a data breach are deeply concerning.

In the third phase of their operation, the attackers leverage the stolen data to craft convincing messages designed to prey on the fears and urgency of potential victims. Guests receive alarming notifications stating that their bookings are in jeopardy of cancellation within 24 hours. To resolve this supposed crisis, they are urged to promptly provide their credit card details under the pretext of a verification "test."

The final blow in this nefarious campaign involves leading the unsuspecting victims to a phishing page meticulously designed to mimic the legitimate Booking.com website. What makes matters worse is that this fraudulent page comes pre-filled with the victim’s personal information, further adding to the confusion. Here, victims are coerced into re-entering their credit card or bank information, unknowingly providing it directly to the attackers.

Research conducted by the security firm has shed light on the widespread nature of this issue, affecting hotels and resorts globally. The financial losses stemming from these attacks can be substantial, and concerns regarding trust breaches and potential data misuse loom large.

The security team at Perception Point has also raised the possibility that this Booking.com phishing attack may be part of a larger pattern, as observed in a previous InfoStealer campaign that targeted hotels and travel agencies. In light of this alarming development, Booking.com users must exercise utmost caution, the security experts added.