Beware of the Booking.com Phishing Scam Targeting Hospitality Workers

An email from Booking.com that appears to be scolding you for an “angry guest” isn’t a disgruntled review at all—it’s a sophisticated phishing scam engineered to harvest your credentials and keystrokes. Microsoft Threat Intelligence has flagged this ongoing campaign, which began in December and was still active as recently as February, as a clear attempt to defraud hospitality organizations around the globe. In this article, we break down the scam, explain the technical details behind its operation, and share what Windows users—especially those in the hospitality sector—need to know to stay protected.

The Anatomy of the Scam​

Rather than a run-of-the-mill negative review, the email is a well-crafted impersonation of a legitimate Booking.com communication. The attackers, tracked by Microsoft as belonging to the group Storm-1865, have a history of leveraging Booking.com-themed lures. Previously, they targeted hotel guests and, more recently, e-commerce platform buyers. Now, they’ve shifted their focus to hospitality employees, a move that puts a spotlight on the increasingly blurred lines between consumer and organizational phishing attacks.

Key Characteristics of the Attack​

• Target Audience: Hospitality employees who often work with or for online travel agencies like Booking.com. The scam spans multiple regions, from North America and Oceania to South and Southeast Asia, and even across Europe.
• Presentation: The email may fool recipients by referencing negative guest reviews, travel inquiry follow-ups, online promotion opportunities, or account verifications. This variety is designed to trigger an immediate emotional response, prompting a quick—and unthinking—click.
• Delivery Methods: These malicious messages are not confined to corporate email systems; they also originate from vendor platforms and common email services such as Gmail and iCloud Mail. Notably, while Microsoft’s own platforms like Exchange are not mentioned, the sheer volume across channels underscores the broad targeting strategy.

How the Phishing Attack Unfolds​

Once the recipient interacts with the email, the scam pivots into its dangerous phase. Here’s a step-by-step breakdown of how the attack unfolds:

1. Deceptive Content: The email contains either a direct link or a PDF attachment with a clickable link. Despite appearing to lead to Booking.com, this link instead redirects the user to an attacker-controlled website.
2. The Fake CAPTCHA Puzzle: On the malicious site, what seems to be a Booking.com landing page is, in reality, a bogus CAPTCHA challenge. This isn’t a mere display error; it’s a decoy designed to trigger the next phase of the attack.
3. ClickFix Technique in Action: The malicious page employs a social engineering trick known as the ClickFix technique. Here, a fake error message instructs users to open the Windows Run dialog (typically using a keyboard shortcut) and paste a command. It’s a calculated move—by prompting a copy-paste action, the scammers bypass natural hesitations and built-in security measures.
4. Malware Payload Delivery: Once the command is executed, it downloads and launches malware on the victim’s device. The payloads include multiple families of commodity malware:
   • XWorm, Lumma Stealer: Tools aimed at extracting keystroke data and sensitive credentials.
   • VenomRAT and AsyncRAT: Remote access tools that could grant attackers control over the affected system.
   • Danabot and NetSupport RAT: More versatile malware capable of executing further malicious instructions.
   These payloads often use the legitimate Windows utility mshta.exe to run scripts in languages like PowerShell and JavaScript or to execute portable executable (PE) files. By exploiting a trusted Windows process, the malware can more easily slip past security defenses.

Technical Insights and Industry Implications​

Why mshta.exe and the ClickFix Technique?​

The use of mshta.exe is a clever, albeit nefarious, method for running malicious code. As a legitimate Windows utility, it is less likely to be blocked by traditional security software. When coupled with the ClickFix technique—where a fake error message tricks the user into executing a command—the attack becomes far more insidious. Microsoft’s own tracking of Storm-1865 highlights that these tactics are not new but have been refined over time to increase the success rate of phishing attempts.

Storm-1865’s Broader Campaign​

Microsoft Threat Intelligence has observed that phishing campaigns under the Storm-1865 umbrella have been steadily increasing in volume since early 2023. These campaigns use similar themes and social engineering techniques. The pattern is consistent:

• Recurring Branding: Emphasizing reputable companies like Booking.com helps attackers lend an illusion of authenticity.
• Multiple Sectors: While earlier targets included hotel guests and e-commerce buyers, the recent focus on hospitality employees broadens the impact, potentially compromising entire organizational networks.
• Multiple Platforms: The use of popular email services ensures that even robust enterprise-level email protections might not catch every phishing attempt.

This broader campaign suggests that Storm-1865 is continuously evolving its tactics and expanding its reach. For Windows users, especially those handling financial or credential-sensitive information, the message is clear: remain vigilant.

Global Impact: Who’s at Risk?​

The campaign explicitly targets hospitality employees who handle critical booking and customer data. Given the international footprint of platforms like Booking.com, no region is entirely immune. The attackers appear to have crafted the emails to resonate with a global audience:

• North America and Europe: Regions with significant hospitality operations and high volumes of online transactions.
• Oceania, South, and Southeast Asia: Emerging markets that are rapidly digitizing and may not yet have the same level of cybersecurity defenses as more developed regions.

The variability in content—from alarmist messages about negative reviews to urgent requests for account verifications—ensures that almost any recipient could be duped. It’s a stark reminder that phishing campaigns have become global operations, transcending regional cybersecurity norms.

Best Practices for Windows Users and IT Administrators​

Given the sophisticated nature of this phishing attack, both individual users and IT departments must adopt a multi-layered approach to cybersecurity. Here are some actionable steps:

• Email Vigilance:
  • Scrutinize any email that creates a sense of urgency. If an email from a well-known brand like Booking.com references negative reviews or urgent actions without prior context, take a moment to verify its legitimacy.
  • Inspect the sender’s email address carefully. Many attackers use email addresses that closely mimic legitimate ones but include subtle discrepancies.
• Link and Attachment Caution:
  • Avoid clicking on links or opening attachments in emails unless you are absolutely sure of their authenticity.
  • Even if the email appears familiar, navigate to the official website manually rather than relying on embedded links.
• Command Prompt Security:
  • Be wary of any prompt that instructs you to copy and paste commands into Windows Run or PowerShell. Such instructions should raise immediate red flags.
  • Use trusted antivirus and anti-malware solutions that monitor and restrict suspicious activities linked to system utilities like mshta.exe.
• Regular Software Updates:
  • Ensure that your Windows operating system and all associated software are up to date. Microsoft’s security patches are designed to address emerging vulnerabilities, including those exploited by phishing campaigns.
• Employee Training:
  • If you’re part of an organization, invest in regular cybersecurity training. Familiarize employees with common phishing tactics and simulate phishing tests to improve awareness.
• Incident Response:
  • Implement and regularly update your organization’s incident response plan. Early detection and swift action can significantly mitigate the impact of a successful phishing attack.

Why This Matters to the Windows Community​

For Windows users, particularly those managing enterprise environments or working in sectors like hospitality, the implications of these phishing campaigns are profound. Microsoft’s ecosystem underpins a vast number of business operations—every unverified click or ill-advised command can potentially compromise sensitive data and disrupt operations.
This phishing campaign highlights a growing trend where attackers blend social engineering with technical exploits. It isn’t just about bypassing firewalls; it’s about manipulating human behavior to facilitate a technical breach. As Windows users, the importance of skepticism in the digital age cannot be overstated. Before clicking “Run” or “Download,” pause and evaluate the source and context of the instruction.
In the age of remote work and digital collaboration, ensuring robust cybersecurity protocols is more than a best practice—it’s a necessity for safeguarding both individual and corporate data.

Conclusion: Staying One Step Ahead​

The ongoing phishing scam masquerading as a Booking.com email is a compelling reminder of how dynamic and adaptive cyber threats have become. With attackers using familiar brand names and leveraging trusted system utilities like mshta.exe, Windows users must be proactive in verifying the legitimacy of every email, link, and attachment.
Storm-1865’s expanding operations underscore the need for a heightened state of alert—especially for those in high-risk sectors like hospitality. By adhering to best practices such as scrutinizing email sources, avoiding suspicious links, and keeping software up to date, users can significantly reduce their exposure to such attacks.
Stay informed, stay cautious, and remember: in the digital world, every click counts. For more detailed insights on safeguarding your system against these types of threats, be sure to check out our in-depth guides and community discussions on Windows security updates.

---

Source: The Register Don't click on that email claiming to be a disgruntled guest