Hotels Targeted by Phishing Campaigns Using Fake Guest Complaints

• •Phishing emails target hotel staff with fake complaints to deliver malware.
• •Malware families EtherRAT and TONResolver exploit public blockchain data.
• •Attackers use generative AI to create varied phishing messages.

Hackers are targeting the hotel industry with phishing emails containing fabricated guest complaints to deliver EtherRAT and TONResolver malware. These emails, which appear to be a continuation of previous Booking.com-themed attacks, exploit hotel employees' responsibilities to investigate guest issues. The emails include malicious LNK shortcut files disguised as images, which execute commands to download the malware. Cofense Intelligence assesses this campaign with moderate confidence, noting the use of generative AI to create varied complaint narratives. The malware utilizes public blockchain data for command-and-control infrastructure, complicating detection efforts. The attacks leverage the accommodation sector's customer service dynamics, posing a significant risk to hotel operations.