- Large-scale credential harvesting campaign targeting hospitality industry professionals
- Impersonates trusted hotel management platforms Expedia Partner Central and Cloudbeds
- Campaigns exploit trust in routine hotel reservation and commission notifications
Threat intelligence
Hospitality-Focused Phishing Campaign Impersonates Expedia and Cloudbeds
By Samantha Clarke, Ankit Gupta and Mimecast Threat Research Team
Key Points
Campaign Overview
Samantha Clarke, Ankit Gupta and Mimecast Threat Research Team have identified an active phishing campaign specifically targeting hospitality industry professionals through fraudulent emails impersonating Expedia Partner Central and Cloudbeds platforms. This credential harvesting operation leverages the routine nature of hotel booking communications to deceive recipients into surrendering their login credentials.
The campaign employs urgent, business-critical subject lines designed to prompt immediate action from hotel managers and staff. Common lures include commission tracking alerts, system updates, guest booking confirmations, and partner central notifications. These subjects exploit the time-sensitive nature of hospitality operations, where delayed responses to guest bookings or system alerts can directly impact business revenue.
The threat actors demonstrate sophisticated understanding of hospitality workflows by crafting emails that reference specific platform features like "Partner Central," "commission tracking," and "guest messages." The emails direct recipients to fraudulent login pages that closely mimic legitimate Expedia and Cloudbeds interfaces, designed to capture usernames, passwords, and potentially multi-factor authentication tokens.
All identified malicious infrastructure utilizes Vercel's application hosting platform, suggesting the attackers are leveraging this service's ease of deployment and legitimate appearance to host their credential harvesting sites. The consistent use of hospitality-themed domain names and subdomains indicates a targeted, industry-specific campaign rather than opportunistic broad-spectrum phishing.
Mimecast Protection
Mimecast has implemented detection capabilities to identify and block emails associated with this hospitality-focused campaign. Our URL Protect service actively blocks access to the identified malicious domains, while our anti-phishing engines detect the campaign's email patterns and subject line characteristics.
