Beware of This new Scam That is Targeting Travelers Through Online Booking Sites
Despite widespread awareness, phishing remains one of the most persistent and effective attack vectors in the world of cyber threats. From scammers posing as reputable banks to text messages mimicking delivery notifications, and even malicious code hidden within seemingly innocuous images, phishing attacks can target anyone with access to digital devices. One scam recently identified by cybersecurity professionals is the utilization of sophisticated infostealers, specifically targeting the hospitality industry through online booking services.
As part of this scam, a fraudster initiates a booking request, opting for the "pay at hotel" option, and proceeds to spam the hotel with a series of urgent and seemingly authentic emails containing links to supposed "photos." However, these links actually lead to the execution of an infostealer, compromising the hotel's security.
While initially aimed at hotels, this nefarious phishing campaign has evolved into a multi-stage attack, subsequently targeting customers of these booking platforms. The attack is carried out in three primary steps, which are executing the infostealer, contacting the victim, and ultimately trapping the victim with a link.
After infiltrating the hotel's system, the attacker first gains access to legitimate customer communications. Typically, users are advised to rely on official communication channels provided by the booking platform to avoid fraudulent interactions. However, with the attacker now able to exploit these trusted channels, such precautions become ineffective.
The attacker proceeds to send personalized messages to intended victims, leveraging typical phishing strategies such as urgency, fear, and the need for immediate action. Crafted to mimic authentic hotel communications, these messages instill a false sense of trust in recipients, further facilitating the success of the phishing scheme. On top of that, the messages are disseminated through the booking platform's messaging system, adding a sense of legitimacy that would otherwise be absent in traditional email-based phishing attempts.
The victim then receives a message containing a deceptive link, purportedly for additional card verification to prevent the cancellation of their booking. Fearing the loss of their reservation, the victim complies with the instructions outlined in the message and clicks the link. This action triggers the execution of a script encoded within a JavaScript Base64 script, which is downloaded onto the victim's device.
The downloaded script is designed to evade detection by security analysts, utilizing various methods to gather information about the victim's browser environment, including browser capabilities and attributes. This data is then compiled into a data object and appears to be transmitted to a server via a POST request.
Following the successful execution of the script, the victim is directed to a phishing site posing as a legitimate payment page, where they are prompted to enter their credit card information. To further enhance the credibility of the scam, the attacker implements a smart-chat support channel.
Several red flags indicate the fraudulent nature of the message, including urgent language warning of reservation cancellation, a suspicious URL that does not match the official website domain, and the presence of threatening language. To mitigate the risk of falling victim to such phishing attacks, individuals are advised to exercise caution and remain vigilant.
