All articles

Published on · Hotels worldwide

The fake Booking.com emails that get front desk staff to paste a command

A negative review, a guest question, an account check: they look like Booking.com messages, but they are not. Microsoft tracked this campaign from December 2024: it gets front desk staff to paste, by themselves, the command that installs a password-stealing program.

In 30 seconds

  1. Fake emails in Booking.com's name reach the front desk with negative reviews or guest questions.
  2. The link leads to a fake «I am not a robot» check that asks you to paste a command into your computer.
  3. The rule for everyone: no real website asks you to paste commands.
When
From December 2024, still active in February 2025
Who
Hotels and travel agencies using Booking
How they get in
Email and a fake check (ClickFix)
What they want
Passwords, the Booking account, guest payments

What happened

In March 2025 Microsoft described a phishing campaign impersonating Booking.com, which started in December 2024 and was still active in February 2025. The emails reach people working at hotels and travel agencies that use Booking: they talk about negative reviews, guest requests and account checks.

Microsoft calls the group behind it Storm-1865 and links it to theft of payment data and fraudulent charges.

How they got in

Here the way in is known, and it is the part to show every member of staff. The link in the email leads to a page that looks like an ordinary «I am not a robot» check. To pass it, the page asks you to open a Windows window and paste a text it has already copied for you. That text is a command: it downloads and runs programs that steal passwords and give remote control of the computer.

The technique is called ClickFix. It works because the dangerous step is taken by a person, not by a program, which is why many automatic defences miss it.

What they can do next

With the passwords taken from the front desk computer, criminals go after the property's Booking account and, from there, guests' data and payments. Booking.com said its own systems were not breached: the weak spot is the property's computer.

What to check in your business today

  1. Teach the whole front desk one rule: no real website asks you to paste commands into your computer. If it happens, close the page and tell someone.
  2. Read Booking messages inside the extranet, opened from your own bookmark, never from links in emails.
  3. Turn on two-step verification for the Booking account and the property's mailbox.
  4. The front desk computer should not have administrator rights: that alone stops many programs from installing.

Sources