EU regulators are investigating Booking.com over phishing, fraudulent listings, and impersonation scams affecting travelers and accommodation partners. The article describes several real campaigns, including fake Booking.com messages that sought payment details from customers and complaint-themed emails designed to make hotel staff run malicious files.
EU regulators are examining whether Booking.com has adequately assessed risks tied to phishing, impersonation, fraudulent listings, and payment fraud affecting travelers and accommodation partners. Several real-world campaigns illustrate how these risks play out. One used stolen partner hotel credentials to message customers directly and request payment details. Another, a ClickFix-style campaign, impersonated Booking.com to push targets toward downloading infostealer malware. A separate campaign against Japanese Booking.com partner accommodations used fake guest complaints and review requests to get hotel staff to execute malicious files.
Each scenario relies on the trust travelers and hotel staff place in familiar booking workflows. A guest complaint or review request feels routine to front desk and reservations staff, which makes an unexpected attachment easier to open without question. On the traveler side, a payment request that appears to come from a hotel or from Booking.com itself can look legitimate, particularly when the attacker has already compromised a partner account and has access to real reservation details. This context makes the fraudulent message blend in with normal communication rather than standing out as suspicious.
Hotel and accommodation staff should verify unexpected guest complaints or review requests through the official partner portal or a known contact before opening any attached file. Travelers and customers should treat payment requests as suspicious even when they appear to reference a real booking, and confirm any request through the official Booking.com app or website rather than replying to the email directly. Organizations should also avoid downloading software or files from unsolicited Booking.com-themed messages. Because compromised partner accounts have been used to target real customers convincingly, accommodation providers should also prioritize protecting login credentials for platforms like Booking.com, since account compromise there can cascade into fraud against guests who have no way of knowing the account was misused.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Campaigns have used spoofed Booking.com emails, fake guest complaints and review requests to hotel staff, and ClickFix-style lures urging recipients to download infostealer malware.
Attackers have used infostealer malware like Vidar to steal partner hotel Booking.com credentials, then used that access to send convincing phishing emails to real customers asking for payment details.
Unexpected guest complaint or review emails that include a file to open or run, especially if they bypass the normal Booking.com partner portal, should be treated as suspicious.
Travelers should avoid providing payment information through email and instead confirm any request directly through the official Booking.com app or website.
That Booking.com message might mention your real reservation, and still be a scam. Here’s the trick: stolen hotel partner credentials can let scammers contact real guests and ask for payment details. Hotel staff also get emails titled ‘Guest complaint / review request’ with a file to run. The aha: real booking details don’t prove the request is real. That complaint file can install an infostealer; that payment message can steal your card details. Before opening a file or paying, check the request directly in the official Booking.com app or partner portal.
Researchers observed a real phishing campaign that abused Microsoft 365’s “Direct Send” feature to deliver messages that looked like they came from trusted internal addresses (HR, accounting, admin). The emails commonly used familiar business lures like invoices, payment approvals, voicemail…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and…
A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal…
Researchers reported two China-aligned campaigns that used phishing and impersonation to target AI policy experts and multiple Asian government organizations. One campaign built rapport with “AI policy” themed outreach before sending links to a OneDrive credential-harvesting page, while another…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
