Phishing Campaigns Are Now Targeting the Hospitality and Tourism Ponds
A phishing campaign is targeting the tourism and hospitality industries, according to researchers at Votiro.
“In this instance, the hacker booked a room at an international hotel and submitted a request for the hotel to get in touch with them immediately via WhatsApp about an urgent issue,” the researchers write. “Once the hotel employee engaged the customer over WhatsApp, the hacker responded with their request. The WhatsApp message looked innocent enough (it even had a ‘waving woman’ emoji in it).”
The message stated, “Hello! I will come to visit you soon and would like to ask for your help. I have run into an allergy problem so I would be very grateful if you could review my list of allergies. The file won’t open on the phone because it’s in the zip folder. I’m on a train and I just can’t open the file any other way. Thank you for your concern and willingness to help me. I really appreciate your time and efforts that you put in to make my stay at your place as comfortable as possible. Folder password: 1111.”
The message had a malicious ZIP file designed to be opened on a computer. The file would install malware on the victim’s machine.
“The malicious actors knew that the weaponized files would not open on an iPhone, and therefore lured their victims to open the weaponized file via WhatsApp Web, which is installed on many office workstations,” the researchers write. “Unfortunately, the employee unknowingly clicked on the weaponized file, input the password, and opened it, potentially exposing the entire hotel network to the hacker’s nefarious plans. Files of this nature can infect the hotel’s computer systems and hold the data for ransom, shut down the security systems to enable a break-in, or lock the reservation system to cause revenue-based damage. As such, the risk was enormous.”
New-school security awareness training can enable your employees to thwart phishing and other social engineering attacks.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW