Homoglyph Phishing Campaign Targets Booking.com Users

• •Threat actors use Unicode homoglyphs to create deceptive URLs.
• •Victims are redirected to a malicious site that installs malware.
• •This phishing tactic has targeted Booking.com users multiple times.

A new phishing campaign exploits Unicode homoglyphs to mimic legitimate Booking.com URLs, using the Japanese hiragana character 'ん' to deceive users. This character can appear as a forward slash in certain fonts, making the malicious links look authentic. Victims clicking on these links are redirected to a fraudulent site, www-account-booking[.]com, which delivers a malicious MSI installer. This installer can potentially drop various malware, including infostealers and remote access trojans. The campaign has been linked to previous phishing attempts targeting Booking.com customers, indicating a persistent threat. Security experts warn that such homoglyph attacks are becoming more common, leveraging psychological tricks to bypass user scrutiny. Users are advised to be vigilant and check URLs closely before clicking.