New Phishing Campaign Exploits Booking.com Partners, Targets Customers in Multi-Stage Fraud Scheme

New phishing activity is again abusing the Booking.com ecosystem to defraud both hotel partners and their guests, using a coordinated multi‑stage campaign that blends email, infrastructure abuse, and social engineering across email and WhatsApp.

The primary objective is financial gain, using tailored phishing kits to first capture partner credentials and then harvest guest payment data.

The operators run a three‑stage infection chain. Stage 1 delivers phishing emails to hotel reservation and service‑desk mailboxes, masquerading as Booking.com “Partner” communications about room availability or guest complaints.

Stage 2 uses a dedicated partner phishing kit to steal Booking.com partner credentials from hotel staff, relying on strong visual impersonation of the official portal and multiple evasion techniques.

Stage 3 then weaponises those stolen credentials to access booking records and launch a second phishing wave against hotel customers, this time via WhatsApp messages that include real booking details and links to a customer phishing kit designed to steal card data.

The final stage strongly overlaps with the “I Paid Twice” campaign previously documented by Sekoia, which also abused Booking.com data and a sophisticated phishing kit to trick guests into paying for reservations twice.

Since early January 2026, investigators have observed renewed malicious activity aimed at the hotel and wider retail sector, with threat actors sequentially targeting two victims: hotels using Booking.com’s partner platform, and the hotels’ customers.

However, the current activity introduces a new partner‑focused phishing kit and delivery model, indicating either an evolution by the same actors or adoption by new operators specialising in partner compromise.

Phishing Campaign Exploits Booking.com

Infection Chain 1 begins with highly structured Gmail senders and homograph‑based domains.

Generated Gmail addresses follow a predictable pattern of 7–11 lowercase letters plus 2–3 digits, and are used to send complaint‑themed emails that reference ongoing or potential stays, increasing urgency and perceived seriousness.

URLs embedded in these emails appear benign, including paths such as “complaint?op_token=” followed by a unique identifier, but resolve through attacker‑controlled infrastructure that visually imitates Booking.com.

The domains leverage IDN homograph tricks, such as substituting Cyrillic “о” for Latin “o” in “booking”, to evade casual inspection while bypassing some email and web filters.

The partner phishing kit pages are carefully constructed to mimic the Booking.com partner login portal, down to the granular use of HTML elements, including individual span tags for each character of the brand name in reverse order.

Domains tied to this kit are all recent (less than 30 days old at time of analysis), use the .com TLD, and cluster around themes like portal administration, identity management, and hotel/property management, for example extrapps‑poratlcenter[.]com, mgmnts‑ids‑center[.]com, and app‑htl‑manage[.]com.

Operators rely on typosquatting and combosquatting, with systematic transposition errors, character omission, and heavy hyphenation such as “poratl” for “portal” or “go‑app‑controls‑poratl[.]com”.

Multi-Stage Fraud Scheme

​To reduce detection, the infrastructure applies root‑domain user fingerprinting, screening visitors via techniques likely involving WebGL, navigator and screen checks, and iframe behaviour, similar to protections seen in front of Evilginx‑style phishing and man‑in‑the‑middle kits.

Non‑targeted or suspicious traffic is served benign‑looking template‑based sites for fake hotel cleaning companies (for example, “Pristinaarax” and “DustifyDoti”), while valid victims are redirected to a fake partner portal hosted consistently on “booklng” subdomains, where “l” replaces “i” in “booking”.

All partner login URLs share the “sign‑in/?tpo_token=” path, offering defenders a clear tracking artefact alongside recurring sender Gmail patterns and favicon/title details from the cleaning decoy sites.

Once partner accounts are compromised, Infection Chain 2 pivots to customers. Threat actors log into Booking.com to pull live reservation data, then send WhatsApp lures, likely from “ghost‑paired” or verified‑looking business accounts, containing accurate stay dates and booking IDs plus a 24‑hour payment or cancellation deadline.

Linked domains resemble those used in partner targeting, with brand‑adjacent wording and hyphenation, followed by an 8‑character alphanumeric path token.

Unlike earlier waves that relied on ClickFix attack and commodity malware such as PureRAT to steal credentials, this campaign shifts towards purpose‑built phishing kits and tailored infrastructure, with artefacts such as Russian‑language error comments in code suggesting development ties to Russian‑speaking actors.

The underlying customer phishing kit matches the one identified in “I Paid Twice”, uses Ajax to auto‑populate stolen booking details, sits behind a Cloudflare CAPTCHA, and employs Dynadot‑registered domains.

Current analysis tracks this activity under intrusion set BR‑UNC‑030, reflecting an ongoing, commercially motivated operation against Booking.com, its hotel partners, and their guests since at least early January 2026.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.