About Us Contact Us Privacy Policy Terms of Use DMCA Opt-out of personalized ads
© Copyright 2023 Market Realist. Market Realist is a registered trademark. All Rights Reserved. People may receive compensation for some links to products and services on this website. Offers may be subject to change without notice.

Beware of This new Scam That is Targeting Travelers Through Online Booking Sites

Utilize reputable security software and cloud services to protect devices from potential threats and phishing attempts.
Cover Image Source: Cyber Fraud | Pexels
Cover Image Source: Cyber Fraud | Pexels

Despite widespread awareness, phishing remains one of the most persistent and effective attack vectors in the world of cyber threats. From scammers posing as reputable banks to text messages mimicking delivery notifications, and even malicious code hidden within seemingly innocuous images, phishing attacks can target anyone with access to digital devices. One scam recently identified by cybersecurity professionals is the utilization of sophisticated infostealers, specifically targeting the hospitality industry through online booking services. 

A smart phone with the travel app is seen on the screen in Hong Kong | Getty Images | Photo by S3studio
Image Source: Getty Images | Photo by S3studio

As part of this scam, a fraudster initiates a booking request, opting for the "pay at hotel" option, and proceeds to spam the hotel with a series of urgent and seemingly authentic emails containing links to supposed "photos." However, these links actually lead to the execution of an infostealer, compromising the hotel's security.

While initially aimed at hotels, this nefarious phishing campaign has evolved into a multi-stage attack, subsequently targeting customers of these booking platforms. The attack is carried out in three primary steps, which are executing the infostealer, contacting the victim, and ultimately trapping the victim with a link.

A 12-year-old boy looks at a iPad screen on October 27, 2023 in Swansea, Wales. Getty Images | Photo by Matt Cardy
Image Source: Getty Images | Photo by Matt Cardy

After infiltrating the hotel's system, the attacker first gains access to legitimate customer communications. Typically, users are advised to rely on official communication channels provided by the booking platform to avoid fraudulent interactions. However, with the attacker now able to exploit these trusted channels, such precautions become ineffective.

The attacker proceeds to send personalized messages to intended victims, leveraging typical phishing strategies such as urgency, fear, and the need for immediate action. Crafted to mimic authentic hotel communications, these messages instill a false sense of trust in recipients, further facilitating the success of the phishing scheme. On top of that, the messages are disseminated through the booking platform's messaging system, adding a sense of legitimacy that would otherwise be absent in traditional email-based phishing attempts.

Image Source: Pexels|Photo by Alex Green
Image Source: Pexels | Photo by Alex Green

The victim then receives a message containing a deceptive link, purportedly for additional card verification to prevent the cancellation of their booking. Fearing the loss of their reservation, the victim complies with the instructions outlined in the message and clicks the link. This action triggers the execution of a script encoded within a JavaScript Base64 script, which is downloaded onto the victim's device.

The downloaded script is designed to evade detection by security analysts, utilizing various methods to gather information about the victim's browser environment, including browser capabilities and attributes. This data is then compiled into a data object and appears to be transmitted to a server via a POST request.

Following the successful execution of the script, the victim is directed to a phishing site posing as a legitimate payment page, where they are prompted to enter their credit card information. To further enhance the credibility of the scam, the attacker implements a smart-chat support channel.

A logo of is pictured on a computer screen | Getty Images | Photo by Yuriko Nakao
Image Source: Getty Images | Photo by Yuriko Nakao

Several red flags indicate the fraudulent nature of the message, including urgent language warning of reservation cancellation, a suspicious URL that does not match the official website domain, and the presence of threatening language. To mitigate the risk of falling victim to such phishing attacks, individuals are advised to exercise caution and remain vigilant.