A sophisticated phishing campaign, masquerading as legitimate emails from Booking.com, is targeting hospitality employees, according to Microsoft Threat Intelligence.

The campaign, which began in December of last year, delivers keystroke and credential-stealing malware to victims’ devices, leaving them exposed to financial fraud and theft. The campaign has been attributed to a threat group tracked by Microsoft as Storm-1865, who are known for conducting phishing campaigns leading to payment data theft and fraud.

The Campaign’s Tactics and Techniques

The phishing emails impersonate online travel behemoth Booking.com, and are designed to exploit the trust and bargain-bagging urgency associated with the platform.

The content of the emails varies, often referencing negative hotel guest reviews, requests from prospective travelers, online promotion opportunities, or account verification requests. These tactics are crafted to provoke a gut reaction, prompting recipients to click on malicious links or open PDF attachments without scrutinising the message’s legitimacy.

Once a recipient clicks on the link, they are redirected to a fake Booking.com webpage that displays a CAPTCHA puzzle. This fake CAPTCHA is part of a social engineering technique known as ClickFix, which instructs users to resolve a fabricated issue by copying and pasting a command into the Windows Run dialog.

This command downloads and executes malware on the victim’s device, bypassing traditional security measures by relying on user interaction.

The malware delivered through this campaign includes multiple families of commodity malware, such as XWorm, Lumma stealer, VenomRAT, AsyncRAT, Danabot, and NetSupport RAT. These payloads are capable of stealing financial data, credentials, and other sensitive information, which can be used for fraudulent transactions and further cyber-attacks.

Recommended reading

• Arctic Wolf Threat Report: Ransomware As A Service On the Rise
• Deepfake Fraud Explodes 2,000% In Three Years
• NHS Staff Don’t Think They’re Cyber Ready, BT Finds

The campaign specifically targets hospitality employees who are likely to work with Booking.com. The timing of the campaign, which began in December 2024, coincides with some of the busiest travel days of the year, making it particularly effective. By exploiting the high volume of communications during this period, the attackers increase their chances of successfully deceiving victims.

In statement given to DIGIT, booking.com said: “Unfortunately phishing attacks by criminal organisations pose a significant threat to many industries. While we can confirm that Booking.com’s systems have not been breached, we are aware that unfortunately some of our accommodation partners and customers have been impacted by phishing attacks sent by professional criminals, with the criminal intent of taking over their local computer systems with malware.

 “The actual numbers of accommodations affected by this scam are a small fraction of those on our platform and we continue to make significant investments to limit the impact on our customers and partners. We are also committed to proactively helping our accommodation partners and customers to stay protected.  A lot of this is via education, informing our partners of the types of scams we are seeing while arming our customers with practical advice that they can apply as they search for and manage their holiday bookings.

 “Should a customer have any concern about a payment message, we ask them to carefully check the payment policy details on their booking confirmation to be sure that the message is legitimate. Customers are also encouraged to report any suspicious messages to our 24/7 customer service team or by clicking on ‘report an issue’ which is included in the chat function. It is important to note that we would never ask a customer to share payment information via email, chat messages, text messages or phone.”

The ClickFix Technique | Exploiting Human Behavior

The ClickFix technique is a key component of this campaign’s success. By displaying fake error messages or prompts, the attackers manipulate human problem-solving tendencies, convincing users to take actions that compromise their devices.

In this case, the fake CAPTCHA page instructs users to open the Windows Run dialog, paste a command, and execute it. This command downloads and launches the malware, enabling the attackers to gain control over the victim’s device and steal sensitive information.

Recommendations for Mitigation

Microsoft has provided several recommendations to help organisations and individuals defend against this threat:

1. Verify Sender Information: Always check the sender’s email address to ensure it is legitimate. Be cautious of emails marked as “[External]” or from unfamiliar senders.
2. Avoid Clicking on Suspicious Links: Hover over links to view the full URL before clicking. If in doubt, navigate directly to the official website instead of following links in emails.
3. Be Wary of Urgent Calls to Action: Phishing emails often create a false sense of urgency to prompt immediate action. Take time to scrutinize the message’s legitimacy.
4. Look for Typos and Errors: Phishing emails frequently contain spelling and grammar mistakes, as well as subtle misspellings of legitimate domains (e.g., “micros0ft.com” instead of “microsoft.com”).
5. Enable Multi-Factor Authentication (MFA): Enforce MFA on all accounts to add an extra layer of security.
6. Use Advanced Security Tools: Deploy tools like Microsoft Defender for Office 365, which includes Safe Links for URL scanning and rewriting, and Microsoft Defender SmartScreen to block malicious websites.
7. Educate Employees: Organisations should provide regular training to help employees recognize and respond to phishing attempts.

The hospitality sector is particularly vulnerable to phishing campaigns due to its reliance on online platforms and the high volume of communications with customers.

Microsoft has warned that this campaign poses a “tangible threat” to hospitality and travel organisations, particularly in the UK.