A sophisticated phishing campaign has emerged targeting the hospitality industry, where cybercriminals impersonate Booking.com to trick hotel staff into installing malware on their systems.
The attack leverages social engineering techniques and exploits the time-sensitive nature of hotel bookings to create a sense of urgency, compelling victims to take immediate action without proper security verification.
The malicious actors send fake Booking.com emails to hotel staff containing what appears to be legitimate reservation details.
.webp)
These emails include check-in dates strategically set only a few days from the email’s arrival date, room specifications, and guest information to enhance credibility.
The deceptive messages instruct recipients to copy and paste a URL into their browser to confirm the booking.
Malwarebytes researchers noted that when hotel employees follow the instructions, they are directed to a fraudulent website displaying a fake CAPTCHA verification interface.
.webp)
The researchers noted this campaign aligns with recently observed fake CAPTCHA schemes targeting various sectors, indicating an evolution in cybercriminal tactics.
Once victims interact with the fake CAPTCHA by checking the verification box, they receive a series of instructions prompting them to perform specific actions on their systems.
These instructions guide users to press the Windows key + R to open the Run dialog box, then paste content from the clipboard and press Enter.
Infection Mechanism
The infection chain’s technical execution is particularly concerning. What victims unknowingly paste into the Run dialog is an mshta command that fetches and executes remote code.
The mshta utility, a legitimate Windows component, allows execution of HTA (HTML Application) files, which can contain JavaScript or VBScript code.
In this case, the command retrieves a malicious script hosted on an attacker-controlled server.
When executed, the payload likely establishes persistence on the victim’s system while attempting to evade detection by security solutions.
The primary objective appears to be accessing customer payment information and personal data stored in hotel management systems, which represents highly valuable commodities on dark web marketplaces.
The attack demonstrates how cybercriminals continue to develop sophisticated social engineering techniques targeting specific industries with custom-tailored approaches, making standard security awareness training increasingly challenging to implement effectively.
Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free
