# Booking.com Impersonation Phishing and Partner-Account Fraud Campaigns (Vidar, ClickFix/Storm-1865, TONResolver) Prompt EU Digital Services Act Investigation

> On 2026-10-21 the European Commission opened formal DSA proceedings against Booking.com over phishing-risk mitigation, guest/reservation data sharing with accommodation providers, its messaging service, impersonation fraud and advertising transparency. The probe follows repeated campaigns that steal hotel-staff Booking.com extranet credentials via infostealers and RATs (Vidar 2023, ClickFix/Storm-1865 2024-2025, TONResolver in Japan 2026) and then phish guests for payment data.

- **Published:** 2026-10-22T23:28:38Z
- **Last reviewed:** 2026-10-22T23:28:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4197
- **ID:** TL-2026-4197
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Storm-1865
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The European Commission announced formal proceedings under the Digital Services Act (DSA) against Booking.com on 2026-10-21 (reported by Infosecurity Magazine on 2026-10-22). The Commission will assess whether Booking.com breached DSA obligations in five areas: (1) risk assessment and mitigation of phishing aimed at customers; (2) safeguards on sharing reservation and guest data with accommodation providers and preventing its misuse; (3) design of the platform messaging service and its abuse potential for phishing; (4) mitigation of systemic risks from impersonation fraud and non-compliant listings; and (5) advertising transparency. Potential penalties are up to 6% of global annual turnover plus corrective measures. Commission Executive Vice-President Henna Virkkunen said Europeans should be able to book holidays without fear of being scammed.

The regulatory action follows a recurring two-stage fraud pattern. Stage one targets hotel/partner staff with spearphishing that impersonates Booking.com, guests or review/complaint notices, to steal extranet (partner portal) credentials or install remote-access malware. Stage two abuses the compromised extranet account and genuine reservation data to message guests via Booking.com messaging, email, WhatsApp or SMS, claiming a payment failure or reservation problem, and harvest card details; in at least one case account bank details were altered to divert revenue.

October 2023 (Secureworks, now Sophos): an incident-response case in which an operations employee received spearphishing from a purported former guest with a lost ID, followed by a Google Drive link to a ZIP containing a Vidar infostealer (photo_2023-09-01_13-21-32.scr), configured to steal passwords only. Vidar C2 used Telegram and Steam profile dead drops and hosted infrastructure. The actor then messaged upcoming guests from the hotel's Booking.com account; guests reported funds taken. Underground forum activity (October 2023) showed buyers seeking Booking.com admin credential logs. Perception Point had earlier reported similar campaigns against hotels and travel agencies delivering Vidar, StealC or Lumma.

December 2024 to March 2025 (Microsoft Threat Intelligence, cluster Storm-1865): emails impersonating Booking.com about a negative guest review, with a link or PDF attachment containing a link, led to a fake CAPTCHA page over a mock Booking.com background. ClickFix instructions (Win+R, paste, Enter) ran a command that used mshta.exe to drop XWorm, Lumma Stealer, VenomRAT, AsyncRAT, DanaBot or NetSupport RAT. Targets were hospitality organizations in North America, Oceania, South/Southeast Asia and Europe; XWorm was seen almost twice as often as any other family.

May to June 2026 (Japan): from Golden Week 2026 Japanese hotels saw a surge of phishing and guest-fraud reports; the Japan Hotel Association issued a formal warning on 2026-06-12, HKCERT warned of Booking.com phishing exploiting suspected leaked booking data on 2026-06-15, and the Japan Tourism Agency demanded investigation on 2026-06-17 (per press coverage). Polaris Holdings disclosed on 2026-05-28 that a third party accessed its group Booking.com account and altered bank details, with about 9 million yen diverted at one property. Booking.com maintains compromises stem from partner credentials obtained via social engineering, not from its infrastructure. TrendAI Research (Trend Micro, 2026-06-29) analysed phishing emails impersonating guest complaints and review requests (including Gmail-based conversational lures and a scheduling-tool notification relay that passed SPF/DKIM/DMARC) delivering a ZIP with a .png.lnk shortcut. The LNK ran PowerShell that rebuilt the attacker domain with BigInteger arithmetic, fetched a PS1 that downloaded Node.js v24.13.0 into %USERPROFILE%\AppData\Local\Nodejs, and ran the TONResolver JavaScript RAT (TrojanSpy.JS.TONRESOLVER.A). The malware resolves its current C2 domain from a TON blockchain smart contract via tonapi.io, connects over WebSocket with ECDH (secp256k1) key exchange and AES-256-CBC, keeps a 20-second keepalive, persists via an HKCU Run key, and supports JavaScript, file and PowerShell execution; follow-on credential theft from Chrome/Edge data and LSASS abuse was observed. Press coverage of the Japan wave also cites ClickFix payloads including PureRAT and ResolverRAT and Norton-attributed figures (350+ hotels in 50 countries); these secondary figures were not independently verified.

No CVEs are involved; the exposure is social engineering of partner staff, credential theft, and absence of mandatory MFA on partner accounts as reported by press. No single actor is attributed across the whole campaign family; only the 2024-2025 ClickFix wave is attributed (Storm-1865, Microsoft).

## MITRE ATT&CK

- T1583.001 Domains
- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1078 Valid Accounts
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1218.005 Mshta
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1003.001 LSASS Memory
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1657 Financial Theft

## Sources

- [EU Regulators to Investigate Booking.com Over Scam Risks](https://www.infosecurity-magazine.com/news/eu-bookingcom-scam-risks/)
- [Vidar Infostealer Steals Booking.com Credentials in Fraud Scam (Secureworks/Sophos)](https://www.sophos.com/en-us/blog/vidar-infostealer-steals-booking-com-credentials-in-fraud-scam)
- [Booking.com customers targeted in hotel booking scam (Help Net Security)](https://www.helpnetsecurity.com/2023/12/04/booking-com-hotel-booking-scam/)
- [Microsoft Warns of ClickFix Phishing Campaign Impersonating Booking.com (The Hacker News)](https://thehackernews.com/2025/03/microsoft-warns-of-clickfix-phishing.html)
- ['ClickFix' Phishing Scam Impersonates Booking.com to Target Hospitality (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/clickfix-phishing-scam-booking/)
- [TONResolver RAT: phishing against Booking.com partner hotels in Japan (TrendAI Research)](https://www.trendmicro.com/en/research/26/f/tonresolver.html)
- [Phishing Alert: Beware of Booking.com phishing messages exploiting suspected leaked booking data (HKCERT)](https://hkcert.org/security-bulletin/phishing-alert-beware-of-booking-com-phishing-messages-exploiting-suspected-leaked-booking-data_20260615)
- [Booking.com's Hotel Extranet Is a Fraud Supermarket - and Japan Is Paying the Price](https://thecybersecguru.com/news/booking-com-hotel-extranet-breach-clickfix-japan/)
- [Japanese hotels fall prey to phishing scams (Bangkok Post)](https://www.bangkokpost.com/business/general/2775646/japanese-hotels-fall-prey-to-phishing-scams)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4197