Loading story…
Cybercriminals used travel-themed phishing lures to exploit renewed interest in trips and bookings, with researchers observing a sharp increase in newly registered travel-related phishing URLs. The activity included Dridex malspam campaigns that abused compromised travel-themed domains such as animalairlines[.]org and soleravacation[.]net to deliver malware, alongside credential-harvesting operations aimed at travelers, travel-industry employees, and customers.
Attackers also hosted phishing content on Google Firebase infrastructure, using fake travel-related pages to steal credentials, customer records, and payment data that could be resold or used in fraud, including so-called shadow travel agency schemes. Researchers said the campaigns reflected broader criminal monetization of travel-sector data, while platform providers including Google and Dropbox removed malicious content after notification and defenders were urged to strengthen phishing protections.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Unit 42 observed a significant increase in travel-themed phishing URL registrations in June 2021 during the broader 2021 rise.
In February and March 2021, another malspam campaign used Excel attachments that contacted soleravacation[.]net to retrieve a DLL that installed Dridex. Unit 42 said the spreadsheets also attempted connections to five or more additional URLs.
Threat actors used phishing pages hosted on Google Firebase to target employees and customers across the travel sector, including hotel, resort, airline, and vacation-rental organizations such as Tui and Palace Resorts.
After Palo Alto Networks shared threat intelligence, Dropbox disabled the malicious sharing links and the associated account used in the January 2021 Dridex campaign.
In January 2021, a malspam campaign used Dropbox links to direct victims to animalairlines[.]org and download a DLL that installed Dridex. The campaign used malicious spreadsheet lures including Rep_598531.xls, Note_7706.xls, Information_24837.xls, and Notification_30123.xls.
Unit 42 observed a gradual increase in newly registered travel-themed phishing URLs starting in early 2021 compared with 2020 levels.
Unit 42 analyzed travel-themed phishing URLs created between October 2019 and August 2021, establishing the observation window for the trend analysis.
Google removed and blocked the Firebase-hosted phishing URLs after Unit 42 notified the company about the malicious content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple financially motivated social-engineering operations designed to steal credentials and enable downstream fraud. Malwarebytes documented a **job-themed phishing** campaign impersonating *Google Forms* via the lookalike domain `forms.google.ss-o[.]com`, using a `generation_form.php` script to generate personalized lure URLs and redirecting victims through a fake form to a credential-harvesting login flow (e.g., `id-v4[.]com`). The infrastructure also used redirection to local Google search pages as an anti-analysis tactic to reduce link sharing and researcher visibility. Separately, Bridewell-reported activity described a **Booking.com-themed, multi-stage phishing and fraud scheme** targeting both hotel partners and guests: initial “complaint”/reservation lures drive staff to attacker-controlled portals using lookalike domains (including **IDN homograph** tricks) to harvest partner credentials, followed by account takeover and guest-facing fraud (including WhatsApp outreach using real booking details). A third report described the broader rise of **Carding-as-a-Service (CaaS)** marketplaces (e.g., “fullz” bundling and platforms such as Findsome and UltimateShop) and the supply chain feeding them (PhaaS credential theft, skimming, and malware), but it did not describe the same specific phishing incidents and should be treated as related background rather than part of the same event.
Jun 29, 2026
Russian-speaking threat actors have orchestrated a large-scale phishing campaign targeting the hospitality industry by registering over 4,300 domains that impersonate well-known travel and booking platforms such as Booking.com, Expedia, Agoda, and Airbnb. The campaign, active since at least February 2025, uses spam emails to lure hotel guests into clicking on links that redirect them to sophisticated fake websites. These sites are designed to appear legitimate, supporting 43 languages and employing brand logos, fake CAPTCHA checks, and customizations based on unique URL strings to increase credibility. Victims are prompted to enter their credit card details under the guise of confirming or paying for hotel reservations, with the sites even simulating 3D Secure verification processes to further the deception. Analysis by Netcraft and security researchers has linked the campaign to Russian threat actors, citing language artifacts in source code and debugger output. The phishing infrastructure is highly organized, with domain names following consistent patterns such as "confirmation," "booking," and "reservation" to enhance the illusion of authenticity. The campaign's scale and technical sophistication pose a significant threat to travelers and the hospitality sector, with the potential for widespread theft of payment data and personal information. Security experts recommend heightened vigilance for unsolicited travel-related emails and verification of booking communications through official channels.
Jul 12, 2026
Multiple reports describe a broader **credential-theft trend** in which attackers abuse trusted services and familiar business workflows to make phishing more convincing and harder to detect. One campaign used **compromised WordPress sites** and redirects through `skimresources[.]com` to deliver pixel-perfect fake login pages for **Microsoft Teams**, **Xfinity**, and **UAE Pass**, with lures such as missed voicemail and shared-document alerts. Another campaign abused **LiveChat**'s `lc[.]chat` infrastructure to impersonate brands like **PayPal** and **Amazon**, moving victims into fake support conversations designed to extract sensitive information under the guise of refunds or order issues. A separate industry report reinforces the same operational pattern: attackers increasingly rely on **valid credentials** and trusted collaboration tools rather than software exploits, with cloud identity compromise driving most investigated incidents and some intrusions using **Microsoft Teams voice phishing** and **Quick Assist** to gain access, move laterally, and deploy ransomware. Other references in the set cover different stories entirely, including the **CamelClone** espionage operation, a **FancyBear/APT28** infrastructure exposure, and a general weekly security recap, and do not describe the same phishing activity. This is **not fluff** because the relevant items contain substantive threat intelligence on active attack methods, delivery infrastructure, and attacker tradecraft.
Jun 29, 2026