Skip to content
Global Phishing Campaign Targets Booking.com and Hotels

Global Phishing Campaign Targets Booking.com and Hotels

First seen 23 Nov 2025, 12:26 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 12, 2026 at 13:27 UTC

A phishing campaign named 'I Paid Twice' has been targeting Booking.com partner hotels and their customers since April 2025. Cybercriminals are using compromised hotel accounts to send phishing emails that trick travelers into providing banking information through spoofed Booking.com pages. The campaign has been linked to the ClickFix malware, which facilitates the theft of customer data.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 197d ago How this analysis works

More articles in this cluster (1)

Following this threat?

Track ClickFix and Tourism in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed