Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data

A Russian-speaking threat actor behind a mass phishing campaign has registered more than 4,300 domain names since the start of the year, aimed at hotel guests and travel bookings. According to Netcraft, there are 4,344 domains tied to the attack, with 685 containing the name Booking, 18 Expedia, 13 Agoda, and 12 Airbnb, signalling attempts to mimic major travel platforms.

The campaign began in earnest around February 2025 and uses a sophisticated phishing kit that customises the page shown to visitors based on a unique URL string, incorporating logos from Airbnb and Booking[.]com. The pages support 43 languages, and victims are prompted to pay a hotel deposit by entering card details, with a subsequent “3D Secure verification” step presented by a fake chat window. The attackers’ identity remains unknown, though there are hints of Russian in source code comments and debugger output.

Netcraft notes that victims’ card data, including expiry and CVV, can be exfiltrated through automated flows as users are redirected through the fake site.