Loading story…
Gen Threat Labs reported that more than 350 accommodations in 50 countries were tied to "Reservation Hijack" scams that used real booking details to target travelers with convincing phishing messages. The campaigns delivered fraudulent payment requests through SMS, WhatsApp, email, and in-app messages, directing victims to fake accommodation-branded payment pages. Researchers said the activity appeared organized and repeatable, citing shared phishing-page components, repeated asset paths, fake live-support chat features, and common card-validation language across multiple incidents.
The findings followed Booking.com warnings to customers that unauthorized parties may have accessed reservation-linked information and reset reservation PINs, indicating exposure of private booking data that could be used to personalize scams. Gen said the largest concentration of affected properties was in Europe—especially Germany, France, the United Kingdom, Italy, and Spain—but the activity also reached the United States and other regions. The company urged travelers to verify payment requests only through official booking channels, while accommodations were advised to strengthen MFA, account monitoring, endpoint protection, and staff phishing awareness.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Gen Threat Labs expanded its investigation into "Reservation Hijack" scams and reported evidence connecting more than 350 compromised accommodations across 50 countries to booking-specific phishing attacks. The researchers said the activity appeared organized and repeatable based on shared phishing infrastructure and tactics across campaigns.
Booking.com notified affected customers that unauthorized parties may have accessed reservation-linked information and reset reservation PINs. The notice was tied to booking-specific phishing activity targeting travelers through messages that impersonated accommodations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
gendigital.com
Open sourceskynews.com.au
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are exploiting hotel reservation systems and booking workflows in a fraud campaign dubbed the **Reservation Hijack Scam**, using stolen reservation details and compromised staff accounts to contact real travelers through trusted channels including Booking.com messaging, email, SMS, and WhatsApp. Researchers said the scam is especially effective because messages arrive in legitimate conversation threads or from authentic hotel accounts, making fake payment requests appear to be routine customer service. Victims are then directed to spoofed guest portals, branded PDFs, or typo-squatted payment sites designed to steal card details or induce bank transfers. In more advanced intrusions, attackers first phish hotel employees for credentials to hospitality platforms such as **Cloudbeds**, or gain persistent access by tricking partners into running malicious commands that deploy a remote access trojan. Cloudbeds said observed cases were caused by credential phishing rather than a breach of its platform. The activity has been reported most heavily in the **UK, France, Germany, the US, Brazil, and Australia**, prompting recommendations that travelers verify payment requests only through official hotel or booking channels, while hospitality organizations strengthen phishing-resistant authentication, access controls, monitoring, and incident response.
Jun 29, 2026
National CERT teams in Croatia and Slovenia warned that attackers are using stolen accommodation reservation data to run highly convincing phishing campaigns impersonating **Booking.com** and lodging providers. The messages, often sent from foreign phone numbers over **WhatsApp** and sometimes via **Viber** or SMS, cite real guest names, phone numbers, stay dates, and booking details to claim there is a payment problem or reservation issue, then direct victims to fraudulent websites designed to capture bank card information or induce unauthorized payments. The warnings follow confirmed security incidents involving **Booking.com** and the Croatian hotel reservation provider **Phobs**, whose systems exposed personal, contact, and reservation data used by accommodation providers across the region. Booking.com said unauthorized parties accessed some users’ reservation information but not home addresses or payment card numbers, while SI-CERT said there is no indication financial data was stolen from Phobs; however, both incidents created enough context for realistic social engineering. CERT authorities urged travelers to verify any payment request only through Booking.com’s official app or website or by contacting the accommodation provider through an independent channel, and advised anyone who submitted card data to notify their bank immediately and report financial theft to police.
Jul 24, 2026
Finland’s National Cyber Security Centre warned that phishing campaigns targeting hotel reservations are abusing **Booking.com** and related accommodation services with messages that look legitimate because they contain real booking details. Victims have received messages shortly after making reservations, sometimes through **Booking.com’s own messaging channel** and sometimes via **WhatsApp**, with references to genuine hotel names, customer identities, and actual reservation information. The messages often begin as routine confirmations before claiming there is a problem with the booking, identity verification, or payment card. The fraudulent messages direct travelers to spoofed websites designed to mimic hotel or booking pages and steal payment-card data. Finnish authorities said the accuracy of the information strongly suggests attackers obtained access to hotel or reservation accounts, likely through phishing or other account compromise, allowing them to view reservation records and in some cases prior conversation history. Officials said similar incidents have been reported for years, with a notable rise in reported cases, and advised customers to verify any payment or identity requests through independent contact channels with the hotel or booking provider.
Jun 29, 2026