A Deceptive Ad Campaign Is Stealing Credentials from the Hospitality Industry

The Daily CyberSecurity article published on 2 September 2025 reports Okta Threat Intelligence’s warning about a large-scale phishing campaign impersonating major hospitality and vacation rental providers. The attackers rely heavily on malicious search engine advertisements, particularly Google Search sponsored ads, to lure victims to deceptive login pages that mirror trusted hospitality brands.

Okta notes that at least thirteen hospitality companies have been impersonated, with screenshots showing clones of portals for services such as Airbnb and Oracle Hospitality. The campaign is designed to harvest credentials and to bypass or capture MFA codes, with some pages prompting for “One time password” or offering “Sign in with SMS Code” and “Email Code” options.

A deeper look into the phishing pages’ source code reveals Russian-language comments and error messages, and Okta points to a Russian-speaking operator tied to a large Russian datacenter proxy provider for attacker sign-ins. The infrastructure also includes beaconing for tracking and analytics to gather real-time information about victims, and experts urge organisations to monitor for suspicious login attempts, educate users about malicious ads, and adopt phishing-resistant MFA.