Phish and Chips: Russian-Speaking Cyber Crooks Reel in Hotel Guests with Scams!
Russian-speaking threat actors are spearheading a mass phishing campaign targeting the hospitality industry with over 4,300 fake domain names. Using sophisticated tactics, they lure unsuspecting hotel guests into sharing credit card information by mimicking travel booking sites like “Booking” and “Expedia.” Beware: even your vacation plans aren’t safe from cyber trickery!
Hot Take:
Oh, the places you’ll go! But not with your money, if this Russian-speaking threat group has anything to say about it. With a phishing toolkit that could make even the most seasoned traveler second-guess their itineraries, they’re proving that if you book it, they will come—for your credit card info, that is!
Key Points:
- Over 4,300 domains registered by a Russian-speaking threat group for phishing since early 2025.
- Targets primarily hotel guests; uses popular travel brand names like Booking, Expedia, Agoda, and Airbnb.
- Phishing emails lure victims with fake booking confirmations leading to bogus websites.
- The phishing kit is multilingual and uses fake CAPTCHA to mimic Cloudflare security checks.
- Phishing-as-a-service (PhaaS) is enabling large-scale attacks with pre-built, automated frameworks.
Already a member? Log in here