New Phishing Campaign Targets Travelers via Compromised Hotel Booking.com Accounts

Cybersecurity researchers have uncovered a multi-stage phishing campaign that uses compromised hotel Booking[.]com accounts to defraud travellers worldwide. The operation has been active since at least April 2025 and begins by compromising hotel administrators’ systems with malicious emails that employ the ClickFix social engineering tactic, ultimately installing PureRAT malware.

Once attackers gain control of a hotel's Booking[.]com account, they exploit the established trust between the platform and customers to execute targeted banking fraud against guests. The initial compromise is followed by spear-phishing messages to hotel reservations and administration addresses, masquerading as Booking[.]com communications and using authentic branding to entice clicks.

Victims who follow the links land on a redirection chain that leads to a malicious site prompting a copied command which, when executed, downloads PureRAT and grants persistence to the attackers. With compromised accounts in hand, threat actors then target guests via WhatsApp or email, steering them to phishing pages designed to harvest banking details and enable second-billing fraud, with prices for high‑value Booking logs advertised on criminal forums. according to Sekoia[.]io