Holiday Season Phishing Surge Targets Hotels: Bookingcom Scam on the Rise

As the holiday season approaches, hotels, guesthouses, and independent property owners are preparing for one of the busiest periods of the year. Unfortunately, cybercriminals are doing the same. Security researchers are warning of a sophisticated phishing campaign impersonating Booking.com, aimed at tricking property partners into installing malware that can steal credentials and take remote control of their devices.

According to Viorel Zavoiu from Bitdefender Antispam Lab, this campaign exploits the urgency and high volume of seasonal communication to deceive hotel staff. Unlike typical credential-harvesting scams, these emails are meticulously designed to mimic real Booking.com messages, complete with spoofed branding, fake “extranet” URLs, and Blogspot redirectors. Once clicked, recipients are guided through a fake verification process that installs malware capable of harvesting sensitive data.

This phishing attack, first observed in mid-November, is timed perfectly for the holiday rush. Hotels, B&Bs, and small rental properties are inundated with legitimate notifications, last-minute reservation changes, and guest complaints. Attackers exploit this environment, sending subject lines like “Booking Guest Complaint Received 5594458883” or “Client Grievance Acknowledged” to trigger immediate responses.

The scam directs recipients to a convincing, spoofed Booking.com extranet page instructing them to run a hidden PowerShell command. This command downloads a malware loader that ultimately deploys AgentTesla, an infostealer and remote-access trojan capable of collecting credentials, keystrokes, screenshots, and other sensitive information. The attack leverages DLL sideloading techniques, injecting malicious payloads into memory to evade detection.

Key regions targeted include the UK, US, Germany, Italy, Australia, Ireland, South Africa, Japan, and the Netherlands. Smaller properties are particularly vulnerable due to their reliance on the Booking.com extranet during peak season. The timing of the attack, combined with its realistic presentation, significantly increases the likelihood of staff falling for the scam.

Signs to watch for include unfamiliar or urgent subject lines, Blogspot redirector URLs, unexpected requests to run system commands, and strange account behavior such as missing notifications or logins from unusual locations.

Bitdefender offers comprehensive protection at every stage of this attack chain, from malicious email blocking and PowerShell attack prevention to malware loader and AgentTesla detection. Recommendations for hotels and small properties include hardening login credentials with two-factor authentication, keeping devices updated with reputable security software, verifying suspicious emails before reacting, and separating guest data from general browsing.

What Undercode Say:

This campaign highlights a critical trend in cybercrime: attackers are increasingly targeting small and medium-sized businesses (SMBs) during peak operational periods. By exploiting the holiday rush, scammers increase the probability of human error, knowing that stressed staff may act quickly without verifying authenticity. The use of spoofed extranet pages, fake verification processes, and advanced malware like AgentTesla demonstrates a sophisticated, multi-stage attack strategy that goes far beyond simple phishing.

The method of delivery—via seemingly legitimate Booking.com communications—capitalizes on trust and urgency. Hotels often receive numerous legitimate alerts during peak season, creating the perfect environment for attackers to hide in plain sight. The inclusion of PowerShell scripts and DLL sideloading reflects a deeper technical knowledge among threat actors, indicating that small businesses are now on the radar for advanced persistent threat (APT)-style operations, not just casual scammers.

For SMBs, the implications are severe. A single compromised device can expose reservation data, payment information, and guest communication, potentially leading to financial loss, reputational damage, and regulatory consequences. The sophistication of the attack emphasizes the need for layered defense strategies: not only robust cybersecurity software but also employee training, strict login protocols, and clear operational policies regarding email verification.

Bitdefender’s layered protection approach—blocking emails, detecting malicious scripts, and preventing malware execution—demonstrates the value of proactive endpoint security for SMBs. However, technological defenses alone are insufficient. Employees must be trained to recognize phishing indicators, verify sender domains, and avoid running commands sent via email.

Geographically, the campaign’s spread across Europe, North America, and Asia suggests that attackers are scaling operations globally, not just targeting one market. This underscores the universal vulnerability of SMBs that rely on online booking platforms. Small hotels and independent property owners should treat digital hygiene with the same urgency as physical security, particularly during high-risk periods like the holiday season.

Ultimately, this phishing operation is a textbook example of social engineering combined with technical exploits. Attackers prey on cognitive overload, using urgency and authority to manipulate users. The sophistication of the payload, combined with timing and realistic messaging, makes it clear that small businesses cannot afford complacency. Cybersecurity must be integrated into daily operational workflows, particularly during peak periods when the likelihood of mistakes increases.

Fact Checker Results:

✅ Verified: Attackers impersonate Booking.com using fake extranet pages.

✅ Verified: Malware deployed is AgentTesla, an infostealer and RAT.
❌ Misconception: Booking.com never asks partners to run PowerShell or verification scripts.

Prediction:

As online booking platforms continue to dominate SMB operations, phishing campaigns will evolve in sophistication, particularly around peak holiday periods. Expect attackers to increasingly combine social engineering with advanced malware delivery, exploiting stress and urgency. Hotels and property owners will need to adopt multi-layered defenses and continuous staff education to remain resilient against future attacks. 🔒📈

If you want, I can also condense this into a highly clickable news-style version for immediate publication that keeps all analytics intact. Do you want me to do that next?