Recent Hospitality Cyber Attacks

Akamai documented scam operations that use large numbers of look-alike shopping and ticketing websites to steal payment and identity information. The operators can quickly replace a removed site with another domain connected to the same payment-data collection system. Other campaigns used…

EU regulators are investigating Booking.com over phishing, fraudulent listings, and impersonation scams affecting travelers and accommodation partners. The article describes several real campaigns, including fake Booking.com messages that sought payment details from customers and complaint-themed…

EU regulators are investigating whether Booking.com has done enough to stop criminals from posting fake properties and taking over real property-owner accounts. The reported scam workflow involves attackers posing as accommodation owners and sending guests messages demanding additional payments,…

Nach einem Angriff auf einen Buchungsdienstleister für Tourismusbetriebe wurden Gästedaten zahlreicher Unterkünfte gestohlen. Die Täter nutzen Namen, Kontaktdaten und Buchungsnummern, um Urlauber mit glaubwürdigen Phishing-Nachrichten zur Herausgabe ihrer Kreditkartendaten zu verleiten.

Microsoft reports a real Midnight Blizzard-linked campaign where attackers tamper with hotel Wi‑Fi captive portals to redirect travelers to phishing and fake update pages. The goal is to steal credentials or trick users into installing malware, which can follow employees back into corporate…

Cofense tracked real email campaigns targeting hotels with fake guest complaints, reviews, and inquiries. The emails push staff to click a link and open what looks like a photo or video, but it leads to a disguised Windows shortcut (LNK) that installs remote-access malware. The malware hides its…

The article highlights real-world voice-phishing attacks where criminals impersonated employees to persuade help desks to reset passwords or approve Microsoft Entra authentication steps, effectively bypassing MFA. It cites major incidents affecting Las Vegas casinos (including MGM Resorts and…

Microsoft reports Russia-linked Star Blizzard sent fake event invitations and other business notices to trick targets into opening disguised files that install a Windows backdoor. The campaigns targeted Ukraine-linked people and organizations and hit 100+ organizations, mainly in the U.S. and U.K.,…

Microsoft reports that the Russian state-linked actor Star Blizzard ran large-scale phishing campaigns in 2026 that use convincing lures like tax notices, fines, and “closed-door” event invitations. After a victim replies, the attacker sends a password-protected ZIP/RAR attachment that triggers a…

This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…

Microsoft describes multiple real-world campaigns where attackers use trusted business workflows to trick people into granting access. One campaign impersonates IT support in Microsoft Teams to get remote control of a device, then spreads across the enterprise. Another campaign targets travelers on…

Anthropic says it disrupted a Russian state-linked campaign that used Claude to continuously rebuild malware when security tools detected it. The group (GTG-20006, linked to Midnight Blizzard/APT29) ran phishing and other human-targeted schemes, including device-code token theft against Microsoft…

Multiple real-world intrusions used a ClickFix-style lure where victims visiting compromised websites saw fake CAPTCHA prompts and were tricked into running a command themselves. Separately, attackers also abused the legitimate, signed Node.js runtime (node.exe) to run malicious JavaScript while…

A threat actor called “TheHatman” claims they stole and posted large internal employee directories from multiple Fortune 500 companies’ Microsoft Azure tenants. Hudson Rock says the leaked samples look like real Azure directory exports, but the exact way the attacker got in is still unclear. One…

Researchers say the BlackFile extortion group is actively targeting large financial and other organizations using voice-phishing calls where attackers impersonate IT support to get initial access. Victims are then pressured with multimillion-dollar extortion demands and, in some cases, escalations…

Attackers are compromising public Wi‑Fi equipment (such as in hotels and conference centers) and changing DNS settings so victims are silently redirected to look‑alike login pages. The goal is to capture usernames and passwords, including Microsoft 365 credentials, when users try to sign in.

A passenger on a Delta flight allegedly set up a look‑alike Wi‑Fi network (“Delta WiFi FAST”) and tried to disrupt the real onboard Wi‑Fi so other passengers would join the fake hotspot. The goal was likely to push users to a login page and capture credentials (e.g., Google or Facebook). This is a…

Uber Freight is investigating unauthorized access after the Helix extortion group claimed it stole nearly one million files from company cloud and email repositories. Google-linked research says the broader cluster (UNC6671) commonly gets in by calling employees and posing as IT helpdesk staff…

A passenger on a Delta flight allegedly set up a look‑alike in‑flight Wi‑Fi network (“Delta WiFi Fast”) to trick other passengers into connecting. Reports say the fake hotspot led to a phishing page intended to steal personal credentials, including Google login data. Delta confirmed the incident…

Delta is investigating an onboard incident where an unauthorized Wi‑Fi network appeared on a flight and the crew shut off Wi‑Fi for about 30 minutes. Reports say a rogue network named “Delta WiFi Fast” may have been used to trick passengers into connecting and potentially entering credentials into…