Scammers are hijacking hotels' Booking.com accounts and using them as part of a hotel booking scam aimed at tricking guests into sharing their payment card information.
Secureworks outlined an attack that occurred in October 2023, when a scammer contacted a hotel's operations staff member by email, pretending to be a former guest and claiming they had left their password at the property.
This first email did not contain links or attachments, i.e., nothing that would trigger email security scanners.
It's function was to establish the recipient's trust and prime them for following the instructions in the second email.
A few days later, the scammer contacted the staff member via email again, ostensibly to provide a photo of the document in question and check-in details, downloadable from Google Drive.
The second email, with the malicious Google Drive link.
The downloaded ZIP archive file contained the Vidar infostealer, which harvested the credentials for the hotel's Booking.com account, allowing the attacker to access the Booking.com management portal, access the list of upcoming bookings and directly send out emails to booked guests.
A few months ago, Perception Point researchers uncovered a similar campaign targeting hotels and travel agencies.
The attackers first booked a stay via email and, after having established trust with a member of the hotel's operation staff, they would request specific favors.
The first email would set the stage for the ask, and the second one contained the URL to the documents, hosted on legitimate services.
As in the campaign outlined by Secureworks, the downloaded archive file actually contained an infostealer: Vidar, StealC, or Lumma.
Hospitality industry and its customers are under attack.
The hotel booking scam targeting Booking.com customers has been going on for a while.
There have been news reports about losses suffered by hotel guests, and extensive forum threads by victims and almost-victims sharing their experiences of having been targeted, usually via Booking.com communication channels.
The scam seems to be highly successful and lucrative, and Secureworks has been seeing high demand on underground forums for Booking.com property credentials.
They should be suspicious of such messages even if they come through legitimate channels.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Mon, 04 Dec 2023 10:43:05 +0000