Phishing Campaign Exploits Ads to Breach Hotel Property Management Systems

A sophisticated malvertising campaign targeting hoteliers and vacation rental operators impersonates well-known hospitality service providers, with Okta Threat Intelligence reporting that attackers have bought sponsored ads on Google Search to steer users to counterfeit login portals.

Beginning in mid-2025, researchers noted at least thirteen reputable hospitality and vacation-rental technology vendors being impersonated, with top sponsored results directing users to look-alike domains that exploit typosquatting of legitimate URLs. Victims encounter highly convincing replica login pages that request corporate email, password and even phone numbers, enabling credential harvesting and MFA bypass through One-time password or SMS/Email codes.

The campaign also employs beaconing to gather real-time analytics on victims, such as visitor metrics, geolocation, and bot activity, to refine social engineering and evade detection.

According to Okta Threat Intelligence, at least a dozen hospitality technology providers have been impersonated, and threat actors may use stolen credentials to access reservations, guest data and financial information, potentially enabling further exploits; mitigation suggestions include phishing-resistant authenticators, adaptive risk assessments, domain monitoring and user awareness.