New Wave of Hospitality Phishing Attacks: Compromise User Credentials, Then Go Phish

Travel-RElated Phishing ScamsThe hospitality sector is seeing a new wave of phishing attacks.

These new attacks are more plausible because they begin with compromised credentials and move to fraudulent emails sent from within a trusted network. The compromised systems are legitimate booking sites; the victims are the guests.

Akamai, which has described the trend, outlines a three-step attack chain.

Step 1: Executing the infostealer.” This step gives the attackers access to messaging functionality likely to be trusted by the victims. As Akamai notes, “It is often recommended that customers use only official and known methods of communication, such as various messaging platforms within the site, to prevent illegitimate or scam interactions. Unfortunately, this great advice becomes moot now that the attacker can access those methods.”

Many people nowadays recognize that, say, Acme Resorts isn’t likely to send them an email from a gmail account. But these attacks come from within Acme Resorts’ system.

Step 2: Contacting the victim.” The content of the message has the usual features of phishing: a sense of urgency, and an inculcation of fear (in this case fear of losing a reservation). Akamai says the phishbait is professionally written, which is true enough insofar as it’s free of the usual grammatical errors.

Still, it’s unusually long and stiffly worded, which might put an alert recipient on guard. Most importantly, however, the phishing message originates from within the booking system.

Step 3: Catching the victim.” The message offers a link to ensure that the victim retains their reservation. The link of course is malicious, and installs an executable on the victim’s device. 

This trend shows criminal adaptation to increasing savvy on the part of prospective targets of phishing. As the attackers adapt, so should the defense. New school security awareness training can help your employees recognize and compensate for the attackers’ new approaches.  

KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Akamai has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews