Cybersecurity researchers warn of an ongoing and highly sophisticated phishing campaign run by a Russian-speaking threat actor — and it’s one of the largest hospitality-focused scams seen this year.
🔍 What’s Happening
Since January 2025, attackers have registered over 4,300 phishing domains, including:
- 685+ “Booking” lookalikes
- 18 “Expedia” clones
- 13 “Agoda” domains
- 12 mimicking “Airbnb”
These fake sites are used to steal credit card details from hotel guests via convincing booking-confirmation scams.
🎣 How the Phishing Attack Works
- Victims receive an email urging them to “confirm their reservation within 24 hours.”
- A link leads to a fake website using:
- Recognizable brand logos
- Realistic booking language
- 43 supported languages
- A bogus Cloudflare-style CAPTCHA hides the attack.
- Victims are prompted to enter credit card info to “secure the reservation.”
- Card data is instantly sent to attackers via automated backend scripts.
The phishing kit customizes the page using a unique AD_CODE, making each victim see a tailored hotel-themed landing page.
🌍 Who Is Affected
This campaign heavily targets:
- Hotel guests
- Hospitality businesses
- Travel platforms
- Users across Central & Eastern Europe
Researchers found strong overlaps with a separate campaign impersonating hotels through WhatsApp and email using malware like PureRAT.
🤖 Phishing-as-a-Service (PhaaS) Behind the Scenes
The campaign appears industrialized:
- Automated domain creation
- Built-in CAPTCHA evasion
- Telegram bot exfiltration
- Multi-stage phishing flows
- Real-time configuration updates
Experts say it reflects the rise of turnkey phishing kits that allow low-skill attackers to run large-scale campaigns.
🛡 How to Protect Yourself
✔ Always verify reservation emails directly in your booking platform
✔ Be cautious of urgent “confirm now” or “48-hour deadline” messages
✔ Check the domain carefully — small typos are a red flag
✔ Avoid entering card details from links in email
✔ Use a virtual card or a card with spending limits for hotel bookings
