Loading story…
Attackers are exploiting hotel reservation systems and booking workflows in a fraud campaign dubbed the Reservation Hijack Scam, using stolen reservation details and compromised staff accounts to contact real travelers through trusted channels including Booking.com messaging, email, SMS, and WhatsApp. Researchers said the scam is especially effective because messages arrive in legitimate conversation threads or from authentic hotel accounts, making fake payment requests appear to be routine customer service. Victims are then directed to spoofed guest portals, branded PDFs, or typo-squatted payment sites designed to steal card details or induce bank transfers.
In more advanced intrusions, attackers first phish hotel employees for credentials to hospitality platforms such as Cloudbeds, or gain persistent access by tricking partners into running malicious commands that deploy a remote access trojan. Cloudbeds said observed cases were caused by credential phishing rather than a breach of its platform. The activity has been reported most heavily in the UK, France, Germany, the US, Brazil, and Australia, prompting recommendations that travelers verify payment requests only through official hotel or booking channels, while hospitality organizations strengthen phishing-resistant authentication, access controls, monitoring, and incident response.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Gen Digital published research describing the Reservation Hijack Scam as a fast-growing fraud campaign affecting hospitality workflows in regions including Western Europe, the United States, Brazil, and Australia. The report detailed tactics such as fake guest portals, spoofed payment pages, branded PDFs, and typo-squatted domains used to steal card or bank transfer details.
Cases involving Cloudbeds-connected hotel operations were reported in which stolen staff credentials were used to access reservation information and guest communications. Cloudbeds stated the incidents were caused by phishing against users rather than a breach of its platform.
In stronger variants of the scam, attackers phished hotel employees for credentials to hospitality platforms such as Cloudbeds, and in some cases used malicious commands to install remote access malware for persistent access. This gave them access to reservation data and legitimate guest communication workflows.
A fraud pattern dubbed the Reservation Hijack Scam emerged in which attackers abused real hotel reservation details and trusted communication channels to send fake payment requests to travelers. The scam used channels including Booking.com messaging, email, SMS, and WhatsApp to make the requests appear legitimate.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcecybersecuritynews.com
Open sourcegendigital.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gen Threat Labs reported that **more than 350 accommodations in 50 countries** were tied to "Reservation Hijack" scams that used real booking details to target travelers with convincing phishing messages. The campaigns delivered fraudulent payment requests through **SMS, WhatsApp, email, and in-app messages**, directing victims to fake accommodation-branded payment pages. Researchers said the activity appeared organized and repeatable, citing shared phishing-page components, repeated asset paths, fake live-support chat features, and common card-validation language across multiple incidents. The findings followed **Booking.com** warnings to customers that unauthorized parties may have accessed reservation-linked information and reset reservation PINs, indicating exposure of private booking data that could be used to personalize scams. Gen said the largest concentration of affected properties was in Europe—especially **Germany, France, the United Kingdom, Italy, and Spain**—but the activity also reached the **United States** and other regions. The company urged travelers to verify payment requests only through official booking channels, while accommodations were advised to strengthen **MFA**, account monitoring, endpoint protection, and staff phishing awareness.
Jun 29, 2026
Finland’s National Cyber Security Centre warned that phishing campaigns targeting hotel reservations are abusing **Booking.com** and related accommodation services with messages that look legitimate because they contain real booking details. Victims have received messages shortly after making reservations, sometimes through **Booking.com’s own messaging channel** and sometimes via **WhatsApp**, with references to genuine hotel names, customer identities, and actual reservation information. The messages often begin as routine confirmations before claiming there is a problem with the booking, identity verification, or payment card. The fraudulent messages direct travelers to spoofed websites designed to mimic hotel or booking pages and steal payment-card data. Finnish authorities said the accuracy of the information strongly suggests attackers obtained access to hotel or reservation accounts, likely through phishing or other account compromise, allowing them to view reservation records and in some cases prior conversation history. Officials said similar incidents have been reported for years, with a notable rise in reported cases, and advised customers to verify any payment or identity requests through independent contact channels with the hotel or booking provider.
Jun 29, 2026
National CERT teams in Croatia and Slovenia warned that attackers are using stolen accommodation reservation data to run highly convincing phishing campaigns impersonating **Booking.com** and lodging providers. The messages, often sent from foreign phone numbers over **WhatsApp** and sometimes via **Viber** or SMS, cite real guest names, phone numbers, stay dates, and booking details to claim there is a payment problem or reservation issue, then direct victims to fraudulent websites designed to capture bank card information or induce unauthorized payments. The warnings follow confirmed security incidents involving **Booking.com** and the Croatian hotel reservation provider **Phobs**, whose systems exposed personal, contact, and reservation data used by accommodation providers across the region. Booking.com said unauthorized parties accessed some users’ reservation information but not home addresses or payment card numbers, while SI-CERT said there is no indication financial data was stolen from Phobs; however, both incidents created enough context for realistic social engineering. CERT authorities urged travelers to verify any payment request only through Booking.com’s official app or website or by contacting the accommodation provider through an independent channel, and advised anyone who submitted card data to notify their bank immediately and report financial theft to police.
Jul 24, 2026