Fake Booking.com phish uses fake CAPTCHAs to trick hotel staff into downloading malware

A new phishing campaign that uses the fake CAPTCHA websites we reported about recently is targeting hotel staff in a likely attempt to access customer data, according to research from ThreatDown.

Here’s how it works: Cybercriminals send a fake Booking.com email to a hotel’s email address, asking them to confirm a booking.

“Dear Team,

You have received a new booking. Please find the details below:

Reservation number: 5124588434141

Guest Name: Margit Kainz

Check-in Date: 2025-03-25

Check-out Date: 2025-04-01

Room Type: Deluxe Double Room

Guests: 2 Adults

Special Requests:Early check-in requested (before 2 PM)

Payment Status: Payment at property

{link to landing page}

(Copy and paste this link in your browser to confirm booking)

Please ensure the room is prepared according to the guest’s requests.

If you have any questions or need more information, please contact the guest directly or through our platform.

Thank you…