Phishing Attack Impersonates Travel Brands Using 4,300 Malicious Domains

A Russian-speaking threat actor has orchestrated a large-scale phishing campaign that has registered over 4,300 malicious domains targeting travellers since the start of 2025. The operation customises phishing pages to impersonate travel giants such as Airbnb, Booking[.]com, Expedia and Agoda, steering victims to pay for fraudulent hotel bookings. The campaign uses malspam emails claiming to confirm hotel reservations, with links that redirect through intermediary sites before reaching the phishing page.

The pages are designed to evade filters through obfuscated paths and can impersonate different brands depending on an AD_CODE value in the URL, while visitors without a valid AD_CODE see a blank page or error message. Global reach is evident, with pages translated into 43 languages, and a broader data harvesting mechanism that collects card details, chat interactions, and keystrokes.

Of the 4,344 identified domains, 685 contain “Booking,” 18 reference “Expedia,” 13 mention “Agoda,” and 12 invoke “Airbnb,” with the attacker commonly registering 10 to 65 domains per week and a spike of 511 domains on 20 March 2025.