EU regulators are investigating whether Booking.com has done enough to stop criminals from posting fake properties and taking over real property-owner accounts. The reported scam workflow involves attackers posing as accommodation owners and sending guests messages demanding additional payments, including through SMS.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Your Booking.com stay is confirmed. Then this text arrives. It appears to come from your property owner. But scammers can take over owner accounts and contact details, then message guests asking for extra money. That’s the trap: a familiar property name doesn’t prove who sent the message. A confirmed booking, a new payment demand, and changed contact details? Stop. Don’t pay from that message. Open Booking.com yourself and check the payment details in your reservation.
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
A recent scam targets YouTube creators with personalized “paid collaboration” emails that impersonate well-known brands and push victims to a fake collaboration platform. The site then routes victims to a Google sign-in step that can capture credentials or trick users into granting dangerous…
People are receiving iMessage texts that look like a buyer asking about a Facebook Marketplace item, but the attached listing is fake and shows the recipient’s own name as the seller. The personalization is designed to trigger a quick reply (“That isn’t me”), which confirms the phone number is…
A real campaign is targeting logistics firms with fake Google Play pages impersonating well-known logistics brands to trick employees into installing an Android spyware app. Once installed, the spyware can steal newly received SMS messages (including one-time passcodes) and enable call forwarding,…
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
