The rise in cyber crimes has become a major concern as hackers are able to find different ways to breach the privacy wall of users and get access to personal information including bank details. personal information, and more. In the latest update, cybersecurity professionals have made the public aware of a recent scam that targets Booking.com users by placing advertisements on the Dark Web and asking for help in identifying victims. Hackers are impersonating employees on the site by taking advantage of the accommodations that are provided.
The Vidar info stealer was used in the fraud, which was looked into by cyber-security company Secureworks, to steal a hotel's Booking.com login information. According to cybersecurity company Secureworks, the threat actor can identify upcoming reservations and message guests directly if they have access to the Booking.com administration interface.
READ: Elon Musk's X Heading Towards Bankruptcy Amid Exit Of Advertisers? Here's What Reports Suggest
While Booking.com hasn't been compromised, hackers have found ways to access the administrative portals of the specific hotels that make use of the service. Hackers are paying between $30 and $2,000 for each legitimate log, with additional bonuses for consistent providers. Reportedly, hackers seem to be profiting so much from their exploits that they are now giving thousands of dollars to thieves who share hotel site credentials.
According to a Booking.com representative, the company is aware that hackers are targeting certain of its lodging partners by "using a host of known cyber-fraud tactics," as the BBC reported. Responders to Secureworks incidents observed that the threat actor emailed a staff member of the hotel to establish contact.
"The sender claimed to be a former guest who had misplaced an identification document (ID) and asked the recipient for help in locating it. The email contained no attachments or dangerous links, and it was most likely designed to acquire the recipient's trust," according to the security experts.
The employee replied to the email and asked for more details to help the sender, as there was no cause for concern. The threat actor followed up with another email on the misplaced ID. The sender said they firmly thought they left the passport at the hotel and recognised the paperwork as such. The recipient of the email downloaded a ZIP archive file to their desktop upon clicking the link in the email.
A file in this collection was recognised by Microsoft Defender as the Vidar infostealer. Before the malware successfully ran, Microsoft Defender found several unsuccessful attempts at execution, the researchers reported.