New Wave of Hospitality Phishing Attacks: Compromise User Credentials, Then Go Phish

Users have to be constantly vigilant of phishing attacks. This sophisticated scam works, but so do the much simpler scams.

The hospitality sector is seeing a new wave of phishing attacks.

These new attacks are more plausible because they begin with compromised credentials and move to fraudulent emails sent from within a trusted network. The compromised systems are legitimate booking sites; the victims are the guests.

Akamai, which has described the trend, outlines a three-step attack chain.

Step 1: Executing the infostealer.

This step gives the attackers access to messaging functionality likely to be trusted by the victims. As Akamai notes, “It is often recommended that customers use only official and known methods of communication, such as various messaging platforms within the site, to prevent illegitimate or scam interactions. Unfortunately, this great advice becomes moot now that the attacker can access those methods.”

Many people nowadays recognize that, say, Acme Resorts isn’t likely to send them an email from a gmail account. But these attacks come from within Acme Resorts’ system.

Step 2: Contacting the victim.

The content of the message has the usual features of phishing: a sense of urgency, and an inculcation of fear (in this case fear of losing a reservation). Akamai says the phishbait is professionally written, which is true enough insofar as it’s free of the usual grammatical errors.

Still, it’s unusually long and stiffly worded, which might put an alert recipient on guard. Most importantly, however, the phishing message originates from within the booking system.

Step 3: Catching the victim.

The message offers a link to ensure that the victim retains their reservation. The link of course is malicious, and installs an executable on the victim’s device.

This trend shows criminal adaptation to increasing savvy on the part of prospective targets of phishing. As the attackers adapt, so should the defense. New school security awareness training can help your employees recognize and compensate for the attackers’ new approaches. 

Verification tips

• Never click on unsolicited links: Regardless of how legitimate a message may appear, it's best to avoid clicking on links in unsolicited messages.

• Contact the company directly: To confirm the authenticity of such messages, use a different official channel outside the messaging platform to contact the company, such as email or phone number provided by the original site hotel or traveling agency.

• Beware of urgent or threatening language: Be cautious of messages that create a sense of urgency or threaten negative consequences if you don't take immediate action.

• Double-check the URL: Always scrutinize URLs to ensure they match the legitimate website.

• Use reputable security software and cloud services: Protect your devices with up-to-date antivirus software. Consider utilizing high-quality cloud security services that provide advanced threat intelligence.