Researchers found fraudulent holiday-rental websites that copy trusted booking platforms, listings, reviews and reservation details to steal credentials, personal information and payment-card data. The sites pressure travelers with claims that bookings are unconfirmed or about to be canceled, and one used live chat to reassure victims that providing card details was a routine security check.
Fortra's FIRE team identified fake holiday-rental websites that closely copied the branding, listings, host names, ratings and reviews of trusted booking platforms. These sites used several tactics to collect information from travelers. One flow marked a reservation as "Unconfirmed" and required a supposedly free, mandatory verification step that collected a traveler's name, email address, country and phone number. Another page combined a credit-card payment form with live support chat, where an agent reassured visitors their card would not be charged while framing the request as a routine security check. A third version impersonated a well-known experiences and lodging platform using a lookalike domain, asking visitors to sign up with contact details or social-media credentials.
The sites worked because they looked convincing and created pressure to act quickly. Messaging claimed a reservation was unconfirmed, payment had failed, or a booking would be canceled, pushing visitors to respond before checking the website address or confirming through an official channel. The live chat element added a layer of social reassurance that is hard to replicate with a static page alone, directly addressing hesitation at the exact moment a visitor was asked to hand over payment card details. Recognizable logos and familiar sign-in buttons on the lookalike sign-up page also made the credential request appear legitimate.
Travelers and anyone who books travel, including travel coordinators, executive assistants, and finance staff, should treat urgency and limited-time offers as a reason to slow down rather than act fast. The safest approach is to open the official rental platform website or app directly and verify a reservation there, rather than trusting a link in a message or chat prompt. Credentials, especially social-media logins, should never be entered on a page reached through an unsolicited link, even if it includes recognizable logos or familiar buttons. When a chat or page downplays the risk of submitting card details by calling it routine, that reassurance itself should be treated as a signal to pause and verify independently.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They copy real listings, host names, and reviews from trusted platforms, then mark a reservation as unconfirmed to create urgency before asking for personal or payment information.
The live chat responded directly to visitor concerns and framed the credit card request as a routine security check, reassuring victims their card would not be charged to lower their guard.
Warnings that a booking is unconfirmed or about to be canceled, requests for social media credentials after following an unsolicited link, and reassurances during a card data request are all warning signs.
Open the official booking website or app directly instead of clicking through a link, and confirm the reservation status through that official channel.
Your rental booking says ‘Unconfirmed.’ Then support chat offers to help. The site copies familiar listings, host names and reviews. It calls verification free and mandatory, then asks for your name, email, country and phone number. Next comes a card form. The chat says, ‘Your card won’t be charged.’ That’s the trick: a reassuring reply doesn’t make the page real. Before entering anything, open the rental platform’s official app yourself and check your reservation there.
Researchers observed a surge in short "request for quotation" (RFQ) emails that look like routine business inquiries to sales and procurement teams. After the victim replies, attackers send a follow-up link disguised as project documents or a procurement portal that leads to a fake Microsoft…
Scammers are targeting YouTube creators by posing as brands offering sponsorships and sending personalized emails that reference the creator’s videos. Victims are directed to a convincing fake collaboration platform and then prompted to sign in with Google, putting their accounts at risk.
Microsoft observed a ClickFix campaign where compromised websites cache a hidden payload in the victim’s browser, then trick the user into pasting a command (often via Win+R) that executes what’s already on the device. The method helps attackers hide the payload and get around Windows “Run”…
Two US Air Force members ran phishing campaigns to steal employee email credentials, then used spoofed emails to impersonate victims or their business partners. They redirected legitimate wire payments, including transfers of $1.68M and $720K, into accounts controlled by the conspiracy, and also…
Arctic Wolf reports a wave of phone-based social engineering where attackers pose as internal IT, guide executives through “routine” MFA/passkey setup, and then send a company-branded login link that steals Microsoft 365 credentials and session tokens. Once inside, attackers methodically inventory…
Microsoft reports criminals are using “ASCII smuggling” (invisible Unicode tag characters) to hide finance-related phishing keywords inside emails so detection rules miss them. The campaign used many disposable, finance-themed sender domains and was relayed through infrastructure tied to the…
