Hackers are abusing hotel booking notifications to steal credentials in a new phishing campaign
By Sead Fadilpašić
Copyright techradar
Skip to main content
Tech Radar Pro
Tech Radar Gaming
Close main menu
the business technology experts
België (Nederlands)
Deutschland
North America
US (English)
Australasia
New Zealand
View Profile
Search TechRadar
Expert Insights
Website builders
Web hosting
Best web hosting
Best office chairs
Best website builder
Best antivirus
Expert Insights
Don’t miss these
Hackers are looking to steal Microsoft logins using some devious new tricks – here’s how to stay safe
Booking.com phishing scam uses secret characters to trick victims – last-minute holiday hunters beware
Hackers are using fake Zoom or Microsoft Teams invites to spy on all your workplace activity
UK immigration system targeted by hackers – dangerous new phishing campaign hits Sponsorship Management System
Holidaymakers under threat from devious new cyber threat – here’s how to stay safe
Hackers are also going back to school – major campaign hijacks Google Classroom to hit targets
Your employee logins are more valuable to criminals than ever – here’s how to keep them protected
Hackers are stealing Microsoft 365 accounts by abusing link-wrapping services
Hook, line and sinker: how to detect and protect your business from phishing attacks
Massive leak of over 115 million US payment cards caused by Chinese “smishing” hackers – find out if you’re affected
Plane tickets are getting more expensive, and AI bots may well be the reason why — here’s what you need to know
Malicious URLs and phishing scams remain a constant threat for businesses – here’s what can be done
Experts warn this top GenAI tool is being used to build phishing websites
Amazon says it stopped Russian hackers targeting Microsoft logins as Cozy Bear strikes again
That email from finance with your name in the subject line? It might just be a trap – here’s what researchers found about malware delivery
Hackers are abusing hotel booking notifications to steal credentials in a new phishing campaign
Sead Fadilpašić
9 September 2025
Newly discovered campaign targets hotels and other hospitality businesses
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
(Image credit: Getty Images)
Phishing campaign targets hotel staff using fake Expedia and Cloudbeds login pages
Attackers show deep knowledge of hospitality workflows to boost credibility
Hospitality businesses are prime targets due to constant handling of sensitive guest data
Hotels, and other similar businesses in the hospitality industry, are being targeted by an advanced, highly convincing, phishing campaign.
The goal of the attacks is to harvest usernames, passwords, and potentially multi-factor authentication tokens (MFA) from two hospitality-centric platforms: Expedia Partner Central, and Cloudbeds.
This is according to Mimecast’s Threat Research Team, and researchers Samantha Clarke and Ankit Gupta. The team discovered an ongoing campaign distributing “urgent, business-critical subject lines designed to prompt immediate action from hotel managers and staff.”
You may like
Hackers are looking to steal Microsoft logins using some devious new tricks – here’s how to stay safe
Booking.com phishing scam uses secret characters to trick victims – last-minute holiday hunters beware
Hackers are using fake Zoom or Microsoft Teams invites to spy on all your workplace activity
Sophisticated understanding of hospitality workflows
Usually, the email messages discuss common tracking alerts, system updates, guest booking confirmations, and partner central notifications. These are regular topics in the hospitality industry, and are generally time-sensitive. Hotels that fail to address these messages on time usually end up losing revenue.
This means that, whoever is behind this campaign, has “sophisticated understanding of hospitality workflows,” the researchers further explained. The links in the emails then redirect the victims towards malicious landing pages, designed to look identical to login pages of Expedia and Cloudbeds.
This is where the attackers capture login credentials and, potentially, 2FA codes. All of the landing pages were hosted on Vercel, they added.
Sensitive data, such as email addresses, Social Security Numbers, passport and government ID numbers, dates of birth, postal addresses, and similar, are quite valuable to cybercriminals.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsorsBy submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.
They allow them to launch phishing attacks that can give them access to important services, bank accounts, and more. Businesses in the hospitality industry, on the other hand, generate this type of data constantly, making them a prime target for campaigns such as this one.
Less than a month ago, a cybercriminal managed to break into the booking system used by numerous hotels in Italy and steal highly sensitive information on thousands of guests. Before that, high-profile hotel chains, including Marriott and Hilton, all had sensitive customer data leak as part of a supply-chain attack against a partner.
You might also like
Microsoft warns about a new phishing campaign impersonating Booking.com
Take a look at our guide to the best authenticator app
We’ve rounded up the best password managers
Sead Fadilpašić
Social Links Navigation
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
Hackers are looking to steal Microsoft logins using some devious new tricks – here’s how to stay safe
Booking.com phishing scam uses secret characters to trick victims – last-minute holiday hunters beware
Hackers are using fake Zoom or Microsoft Teams invites to spy on all your workplace activity
UK immigration system targeted by hackers – dangerous new phishing campaign hits Sponsorship Management System
Holidaymakers under threat from devious new cyber threat – here’s how to stay safe
Hackers are also going back to school – major campaign hijacks Google Classroom to hit targets
Latest in Security
Compromised files replace npm packages with a combined 2 billion weekly downloads
UK policing watchdog finds National Crime Agency heavily reliant on weak legacy systems
All Plex users should reset passwords in wake of data breach
GitHub supply chain attack sees thousands of tokens and secrets stolen in GhostAction campaign
Insider breaches are a bigger security threat than ever before – here’s how your business can stay safe
This creepy spyware watches you through your webcam and snaps incriminating photos
Latest in News
BREAKING: iPhone 17 Pro revealed – here’s what you need to know
BREAKING: Everything you need to know about the iPhone Air
BREAKING: Here’s what you need to know about the iPhone 17
Apple Watch Ultra 3, Series 11, SE 3, AirPods Pro 3 – all the fitness wearables launched during Apple’s mammoth September event
New Avengers: Doomsday image revealed by the Russo brothers, and Marvel fans are scrambling to work out what it means
Apple event 2025 live as it happened – all the iPhone Air, Apple Watch Ultra 3, AirPods 3 and iPhone 17 Pro news direct from Cupertino
LATEST ARTICLES
I’m a deals expert – here are the best AirPods Pro 3 deals to preorder today
AirPods Pro 3 vs AirPods Pro 2: here’s how Apple’s new earbuds compare to the current model
AirPods Pro 3 vs AirPods 4 – the 6 key differences to help you decide which looks the better buy
Apple Watch Ultra 3 preorders – all the best deals on Apple’s most advanced wearable
Apple Watch Series 11 vs Apple Watch Series 10: Is it worth upgrading straight away?
TechRadar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.
Contact Future’s experts
Terms and conditions
Privacy policy
Cookies policy
Advertise with us
Web notifications
Accessibility Statement
Future US, Inc. Full 7th Floor, 130 West 42nd Street,
Please login or signup to comment
Please wait…
