In recent developments concerning cybersecurity, a sophisticated phishing attack has started targeting users of Booking.com, a popular travel and accommodation booking platform. Cybersecurity researchers at OSINTMATTER have identified a series of highly organized phishing campaigns that compromise hotel managers’ accounts to deceive and scam customers. These attackers have employed a fake domain, extraknet-booking[.]com, which closely mimics the legitimate Booking.com domain, extranet-booking.com. The subtlety of this imitation is designed to trick both hotel staff and travelers into thinking they are interacting with the real website. A distinguishing feature of this malicious campaign is the use of JavaScript obfuscation techniques, including parseInt encoding, and even Cyrillic text, suggesting the possibility of Russian-speaking origins. To make matters worse, the attackers leverage SEO poisoning to boost the visibility of their malicious sites within search results, making it easier for unsuspecting users to fall into their trap.
The Anatomy of the Attack
What makes this phishing campaign notably dangerous is its technical sophistication. One of the more notable elements includes “238 STUN” binding requests, which use non-standard high ports to facilitate data exfiltration and maintain communication with compromised systems. Traditional security measures may not sufficiently detect these specialized methods, making the attacks harder to thwart. The infrastructure supporting this phishing campaign employs dynamic cloaking techniques, which enable the attackers to present different content based on the user’s IP address and browser settings. Depending on these factors, the user may see a fake Booking.com portal, the genuine website, or even an error page. Such adaptability increases the likelihood that the phishers can remain under the radar, continuously evolving their methods to evade detection.
A particularly alarming technical component is the use of UDP hole punching, a networking method that allows attackers to breach NAT firewalls and compromise internal networks effectively. UDP hole punching is primarily used to maintain connections between two parties behind firewalls, but in this context, it’s repurposed for malicious ends. Moreover, the attack also employs iFrames linked to numerous other phishing pages, functioning as centralized hubs for distributing malicious content. By pointing to specific URLs, these iFrames enable centralized control and broad reach, making the phishing operation highly efficient. The varied behaviors of these phishing pages, including timeouts and 404 errors, suggest the use of sophisticated mechanisms like RST injection to further complicate detection and mitigation efforts.
Impact and Implications
The operational methodologies employed by these attackers are not just technically advanced but also strategically multifaceted. Research indicates that this phishing scheme is associated with the “Ninja” Trojan malware, which mainly aims to infect the devices of hotel managers. This infection likely serves as a precursor to exploiting Booking.com’s chat system in subsequent attack phases. Once the malware is in place, it enables attackers to send malicious links directly to customers via the platform’s communication system, increasing the potential for widespread infection and data theft.
Overall, this highly advanced phishing attack combines multiple technical elements — dynamic cloaking, JavaScript obfuscation, and techniques like UDP hole punching. All these methods create a robust and evolving threat ecosystem focused on compromising hotel management systems as a first step. Once those systems are compromised, the attackers then exploit the platform to target unsuspecting customers directly. The primary goal here is not only to extract financial information or personal data but to establish a sustainable method of ongoing exploitation. This complex threat underscores the critical importance of heightened cybersecurity measures and the continuous education of users about potential risks.
How to Stay Safe
A recent cybersecurity development has revealed a sophisticated phishing attack targeting users of Booking.com, the well-known travel and accommodation booking site. Cybersecurity experts at OSINTMATTER have uncovered a series of organized phishing campaigns aimed at compromising hotel managers’ accounts to scam customers. These criminals are using a fake domain, extraknet-booking[.]com, which closely resembles the authentic Booking.com domain, extranet-booking.com. This subtle mimicry is designed to fool both hotel staff and travelers into believing they are on the legitimate website. A standout aspect of this phishing campaign is the use of advanced JavaScript obfuscation techniques, such as parseInt encoding, and even the incorporation of Cyrillic text, hinting at possible Russian origins. To add to the threat, the attackers use SEO poisoning to enhance the visibility of their malicious sites in search results, making it easier for unsuspecting users to be deceived. This complex strategy highlights the urgent need for heightened vigilance and robust cybersecurity measures.