Threat reportPhishingTL-2026-4197
Booking.com Impersonation Phishing and Partner-Account Fraud Campaigns (Vidar, ClickFix/Storm-1865, TONResolver) Prompt EU Digital Services Act Investigation
Booking.com Impersonation Phishing and Partner-Account Fraud (TL-2026-4197), also tracked as Booking.com extranet fraud, is a medium-severity phishing campaign, first published 2026-10-22. It is attributed to Storm-1865 with low confidence, affects Booking.com Partner extranet, guest messaging service and reservation, maps to 17 MITRE ATT&CK techniques (T1003.001, T1036, T1059.001), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 1Storm-1865
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4197
- Threat ID
- TL-2026-4197
- Also known as
- Booking.com extranet fraud, Booking.com ClickFix campaign, TONResolver hotel phishing
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- Storm-1865
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- hospitality, travel, tourism, online-travel-agency, consumer
- Target regions
- Europe, japan, North America, Oceania, South Asia, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Booking.com Impersonation Phishing and Partner-Account Fraud
Malware and tooling: AsyncRAT, DanaBot, Lumma Stealer - S1213, NetSupport RAT, Storm, TrojanSpy.JS.TONRESOLVER.A, Venom RAT, Vidar, XWorm
How Booking.com Impersonation Phishing and Partner-Account Fraud works
On 2026-10-21 the European Commission opened formal DSA proceedings against Booking.com over phishing-risk mitigation, guest/reservation data sharing with accommodation providers, its messaging service, impersonation fraud and advertising transparency. The probe follows repeated campaigns that steal hotel-staff Booking.com extranet credentials via infostealers and RATs (Vidar 2023, ClickFix/Storm-1865 2024-2025, TONResolver in Japan 2026) and then phish guests for payment data.
The European Commission announced formal proceedings under the Digital Services Act (DSA) against Booking.com on 2026-10-21 (reported by Infosecurity Magazine on 2026-10-22). The Commission will assess whether Booking.com breached DSA obligations in five areas: (1) risk assessment and mitigation of phishing aimed at customers; (2) safeguards on sharing reservation and guest data with accommodation providers and preventing its misuse; (3) design of the platform messaging service and its abuse potential for phishing; (4) mitigation of systemic risks from impersonation fraud and non-compliant listings; and (5) advertising transparency. Potential penalties are up to 6% of global annual turnover plus corrective measures. Commission Executive Vice-President Henna Virkkunen said Europeans should be able to book holidays without fear of being scammed.
The regulatory action follows a recurring two-stage fraud pattern. Stage one targets hotel/partner staff with spearphishing that impersonates Booking.com, guests or review/complaint notices, to steal extranet (partner portal) credentials or install remote-access malware. Stage two abuses the compromised extranet account and genuine reservation data to message guests via Booking.com messaging, email, WhatsApp or SMS, claiming a payment failure or reservation problem, and harvest card details; in at least one case account bank details were altered to divert revenue.
October 2023 (Secureworks, now Sophos): an incident-response case in which an operations employee received spearphishing from a purported former guest with a lost ID, followed by a Google Drive link to a ZIP containing a Vidar infostealer (photo_2023-09-01_13-21-32.scr), configured to steal passwords only. Vidar C2 used Telegram and Steam profile dead drops and hosted infrastructure. The actor then messaged upcoming guests from the hotel's Booking.com account; guests reported funds taken. Underground forum activity (October 2023) showed buyers seeking Booking.com admin credential logs. Perception Point had earlier reported similar campaigns against hotels and travel agencies delivering Vidar, StealC or Lumma.
December 2024 to March 2025 (Microsoft Threat Intelligence, cluster Storm-1865): emails impersonating Booking.com about a negative guest review, with a link or PDF attachment containing a link, led to a fake CAPTCHA page over a mock Booking.com background. ClickFix instructions (Win+R, paste, Enter) ran a command that used mshta.exe to drop XWorm, Lumma Stealer, VenomRAT, AsyncRAT, DanaBot or NetSupport RAT. Targets were hospitality organizations in North America, Oceania, South/Southeast Asia and Europe; XWorm was seen almost twice as often as any other family.
May to June 2026 (Japan): from Golden Week 2026 Japanese hotels saw a surge of phishing and guest-fraud reports; the Japan Hotel Association issued a formal warning on 2026-06-12, HKCERT warned of Booking.com phishing exploiting suspected leaked booking data on 2026-06-15, and the Japan Tourism Agency demanded investigation on 2026-06-17 (per press coverage). Polaris Holdings disclosed on 2026-05-28 that a third party accessed its group Booking.com account and altered bank details, with about 9 million yen diverted at one property. Booking.com maintains compromises stem from partner credentials obtained via social engineering, not from its infrastructure. TrendAI Research (Trend Micro, 2026-06-29) analysed phishing emails impersonating guest complaints and review requests (including Gmail-based conversational lures and a scheduling-tool notification relay that passed SPF/DKIM/DMARC) delivering a ZIP with a .png.lnk shortcut. The LNK ran PowerShell that rebuilt the attacker domain with BigInteger arithmetic, fetched a PS1 that downloaded Node.js v24.13.0 into %USERPROFILE%\AppData\Local\Nodejs, and ran the TONResolver JavaScript RAT (TrojanSpy.JS.TONRESOLVER.A). The malware resolves its current C2 domain from a TON blockchain smart contract via tonapi.io, connects over WebSocket with ECDH (secp256k1) key exchange and AES-256-CBC, keeps a 20-second keepalive, persists via an HKCU Run key, and supports JavaScript, file and PowerShell execution; follow-on credential theft from Chrome/Edge data and LSASS abuse was observed. Press coverage of the Japan wave also cites ClickFix payloads including PureRAT and ResolverRAT and Norton-attributed figures (350+ hotels in 50 countries); these secondary figures were not independently verified.
No CVEs are involved; the exposure is social engineering of partner staff, credential theft, and absence of mandatory MFA on partner accounts as reported by press. No single actor is attributed across the whole campaign family; only the 2024-2025 ClickFix wave is attributed (Storm-1865, Microsoft).
MITRE ATT&CK techniques used in TL-2026-4197
Credential Access
T1003.001 LSASS Memory; T1555.003 Credentials from Web Browsers
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.001 Malicious Link; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1573.001 Symmetric Cryptography
Initial Access
T1078 Valid Accounts; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Persistence
T1547.001 Registry Run Keys / Startup Folder
Resource Development
Impact
Affected products and versions in Booking.com Impersonation Phishing and Partner-Account Fraud
- Booking.com — Partner extranet, guest messaging service and reservation data sharing
Vulnerable versions: Accounts without MFA and staff endpoints targeted by phishing - Microsoft — Windows endpoints at hotels and accommodation providers
Vulnerable versions: Endpoints permitting mshta.exe, LNK/script and user-writable Node.js execution
Remediation for Booking.com Impersonation Phishing and Partner-Account Fraud
Immediate actions
- Enforce MFA on all Booking.com partner extranet accounts and rotate extranet passwords for staff who handled suspicious guest-complaint or review-request emails
- Block the C2 and delivery domains and IPs listed in the IOCs at email, proxy and DNS layers
- Review extranet audit logs for unexpected logins, bank-account or payout-detail changes, and outbound guest messages
- Warn guests that the property will never ask for card details over WhatsApp, SMS or email, and to use only the official app/site
Workarounds
- Disable the Windows Run dialog via policy for non-administrative users where feasible
- Block archive downloads from consumer file-sharing links in email for reservation/front-desk staff
Longer-term hardening
- Train hospitality staff on ClickFix (Win+R / Ctrl+V / Enter) and fake-CAPTCHA lures
- Restrict mshta.exe, script-host and LNK execution from user-writable and download paths via ASR/AppLocker/WDAC
- Deploy EDR with detections for Node.js running from AppData, Run-key autoruns created by node.exe, and LSASS access
- Use dedicated, hardened workstations for extranet administration and separate them from general email browsing
Weaknesses (CWE) in Booking.com Impersonation Phishing and Partner-Account Fraud
Timeline of Booking.com Impersonation Phishing and Partner-Account Fraud
- Underground forum user 'cocok' offers premium rates for Booking.com credentials, per Secureworks/Sophos; further buyer activity follows through October 2023 (ParanoidChecker update targeting admin.booking.com on 2023-10-31).
- Public reporting of the Secureworks IR case: Vidar infostealer delivered via ZIP link to steal a hotel's Booking.com credentials, then used to message guests and solicit payment details.
- Microsoft Threat Intelligence reports the Storm-1865 ClickFix campaign (active since December 2024) impersonating Booking.com against hospitality, delivering XWorm, Lumma, VenomRAT, AsyncRAT, DanaBot and NetSupport RAT.
- Polaris Holdings discloses unauthorized access to its group Booking.com account and tampering with bank account details; about 9 million yen diverted at one property (press-reported).
- Japan Hotel Association issues a formal warning after member hotels report coordinated guest phishing complaints following a surge from Golden Week 2026.
- HKCERT publishes a phishing alert on Booking.com impersonation messages (email/WhatsApp) exploiting suspected leaked booking data.
- Japan Tourism Agency reportedly demands investigation and traveler warnings.
- TrendAI Research publishes TONResolver analysis of May 2026 phishing against Booking.com partner hotels in Japan.
- European Commission opens formal DSA proceedings against Booking.com over phishing risk mitigation, data sharing with accommodation providers, messaging service, impersonation fraud and advertising transparency.
Sources cited for Booking.com Impersonation Phishing and Partner-Account Fraud
- EU Regulators to Investigate Booking.com Over Scam Risks
- Vidar Infostealer Steals Booking.com Credentials in Fraud Scam (Secureworks/Sophos)
- Booking.com customers targeted in hotel booking scam (Help Net Security)
- Microsoft Warns of ClickFix Phishing Campaign Impersonating Booking.com (The Hacker News)
- 'ClickFix' Phishing Scam Impersonates Booking.com to Target Hospitality (Infosecurity Magazine)
- TONResolver RAT: phishing against Booking.com partner hotels in Japan (TrendAI Research)
- Phishing Alert: Beware of Booking.com phishing messages exploiting suspected leaked booking data (HKCERT)
- Booking.com's Hotel Extranet Is a Fraud Supermarket - and Japan Is Paying the Price
- Japanese hotels fall prey to phishing scams (Bangkok Post)
Detection coverage for TL-2026-4197
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4197 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.