Hackers Hijack Hotel Booking Workflows to Scam Guests With Fake Payment Requests

Gen Digital researchers uncovered a global "Reservation Hijack Scam" where attackers leverage stolen reservation data and compromised hotel management platforms (e.g., Cloudbeds) to send believable payment verification requests via WhatsApp, SMS, email, or booking-platform messaging. Attackers phish hotel staff for credentials, sometimes deploy a remote access trojan through malicious update commands, deliver professionally styled PDFs hosted on hijacked partner storage, and redirect victims to typo‑squatted domains to steal card and bank details; travellers and hospitality operators are advised to verify payments directly, enable multi-factor authentication, and harden messaging/workflow security.