Travelers targeted with Booking.com refund malware


With travelers spreading their wings for a new season of traveling, attackers are adjusting their campaigns to distribute Agent Tesla malware.

Scammers are targeting users of popular travel-related service providers with malware, masquerading as inquiries from brands such as Booking.com, Forcepoint researchers have revealed.

For example, attackers distribute emails impersonating Booking.com. The letter asks the recipient to check an attached PDF for a card statement.

As anyone who has ever booked a hotel or apartment knows, any last-minute emails from the residence owner can be stressful. Attackers bank on precisely that, as the PDF attachment, in this case, is infected with malware.

Once a user opens the link from the PDF, the URL downloads an obfuscated JavaScript, invoking PowerShell and later deleting the script. The end goal of the attack is to deploy Agent Tesla malware on the targeted system.

“On successful infiltration of the malware, it allows attackers to conduct malicious activities such as data theft and executing commands on compromised systems,” researchers said.

Attackers employ Agent Tesla malware, an advanced remote access trojan (RAT) that functions as a keylogger and information stealer. Agent Tesla is one of the most prominent RATs in circulation, affecting up to 7% of organizations worldwide. The malware targets Microsoft Windows OS-based systems.


More from Cybernews:

Expecting privacy from ChatGPT is like asking the NSA to stop spying on citizens

Startup to launch ultra high-resolution satellites, sparking privacy concerns

Meta’s new team targeting disinformation and AI harms in EU elections

AI fake news sites continue to flood web

Florida man could face 62 years in prison for hacking and related charges

Subscribe to our newsletter



Leave a Reply

Your email address will not be published. Required fields are markedmarked