Hospitality Hackers Target Hotels' Booking.com Logins

Perception Point observed a widespread phishing campaign targeting hotels that use Booking.com: emails trick hotel staff into clicking realistic “Reply to Complaint” or reservation links that lead to convincing fake Booking.com sign-in pages to steal credentials. Attackers aim to access hotel Booking.com profiles to harvest guest PII and payment details and then run highly personalized follow-on phishing against customers; the campaign uses industry-specific social engineering, convincing domains, and generative AI to increase effectiveness.