A large-scale phishing operation is targeting the hospitality industry through malicious search engine advertisements, with cybercriminals impersonating at least thirteen hotel and vacation rental service providers to steal credentials and breach cloud-based property management systems.
Malvertising Drives Initial Compromise
The campaign leverages malvertising, malicious search engine advertisements, to deceive users searching for legitimate hospitality companies.
When users search for targeted businesses, sponsored ads appear above authentic results, directing victims to typosquatted domains that closely mimic legitimate websites.
These sophisticated phishing sites present convincing fake login pages designed to harvest usernames, email addresses, phone numbers, and passwords.
The operation targets cloud-based property management and guest messaging platforms explicitly, suggesting that attackers seek access to sensitive guest data and booking systems.
The threat actors demonstrate advanced tactics to bypass multi-factor authentication (MFA) protections. Phishing pages explicitly prompt victims for “One time password” codes and offer “Sign in with SMS Code” and “Email Code” options to capture authentication tokens in real-time.
Russian-Speaking Actors Behind Campaign
Technical analysis of the phishing infrastructure reveals potential Russian origins. Source code examination uncovered JavaScript error messages in Russian, including “Ошибка запроса” (Request error) and comments stating “Запускаем запрос каждые 10 секунд” (We start the request every 10 seconds).
The campaign also utilized a large Russian datacenter proxy provider during attacker sign-in activities.
The malicious sites employ sophisticated beaconing techniques for tracking and analytics, gathering real-time intelligence about victims, including geolocation data, session duration, and bot detection capabilities.
This allows attackers to monitor victim engagement and optimize their campaigns for maximum effectiveness.
Industry-Wide Impact and Mitigation
Major hospitality providers, including Oracle Hospitality and Airbnb, have been impersonated in this campaign. The targeting of property management systems poses significant risks to the hospitality sector, potentially exposing guests’ personal information, payment data, and operational systems.
Security researchers from Okta Threat Intelligence, including contributor Moussa Diallo, have identified comprehensive mitigation strategies.
Organizations should prioritize phishing-resistant authentication methods, such as passkeys and FIDO2 WebAuthn, and implement adaptive risk assessments to detect unusual access patterns. Additionally, they should monitor for suspicious domain registrations.
The campaign highlights the growing sophistication of phishing operations targeting specific industries.
Hotels and vacation rental companies should warn customers about potential impersonation attempts and implement stronger authentication controls to protect both business operations and guest data from compromise.
Organizations can access detailed indicators of compromise through Okta’s security platform to enhance their defensive postures against this ongoing threat.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
