Hotels Under Attack!!!

High season in the hotel industry means millions of bookings generating millions of euros, with millions of user data managed by hotels and hotel chains a very juicy scenario for cybercriminals.

Since September 2024, we have been observing how cybercriminals target hotels to steal their extranet credentials from Booking, and later launch cyber fraud campaigns against hotel guests.

The sophistication has been increasing, both in the initial attacks on hotels and in the subsequent targeting of users.

Let’s walk through how they operate from the very beginning.

Phase One: Email to the Hotel

They receive an email like this one:

As we can see, it pretends to be a dissatisfied customer sending a complaint to the hotel, attaching a YouTube video supposedly showing the condition of the room.

However, if we look deeper into the link, we see it redirects to reply-youtube[com], as shown in the image below from the Check Point Harmony Email console, where it was detected during a proof of concept.

So, let’s go to that link—what do we see?

A very common tactic: the use (and abuse) of Cloudflare’s anti-bot protection. Threat actors use this for phishing and malware domains for two main reasons:

1. Defense evasion – Many security solutions rely on automated browsing proxies, and this technique often bypasses them.
2. User persuasion – Cloudflare’s “verify human” page is legitimate and widely used across the internet, giving the false impression that what follows is trustworthy.

 

Let’s solve the captcha and access the final URL. What do we find?

Thanks to the Any.run sandbox, we can continue simulating the attack to see what lies beneath. What appears is the infamous “clickfix” or fake captcha.

If we click, we’ll see the following:

By entering the requested character combination, we actually execute a PowerShell command. A colleague jokingly calls it the “self-hack attack,” which is quite accurate we're blindly following the attacker’s steps to run their malicious code.

This process launches a PowerShell command from a trusted system path and establishes persistence on the machine.

Execution Chain:

Files Involved:

• z.hta: Malicious HTA script
• tasklos.ps1: PowerShell loader
• launs.exe: AsyncRAT payload
• DeleteApp.url: Shortcut in Startup folder for persistence
• .lnk file: Used to hide malware execution

Observed Techniques:

• Remote Execution: HTA (T1218.005)
• Execution Policy Bypass: via PowerShell (T1059.001)
• Persistence: Startup folder copy (T1547.001)
• Collection: Clipboard and system GUID
• C2 Communication: via svchost.exe and aspnet_compiler.exe to Russian IPs

MITRE ATT&CK Mapping

Phase	Technique	ID
Initial Access	Phishing (malicious link)	T1566.002
Execution	PowerShell	T1059.001
Execution	HTA Application	T1218.005
Persistence	Startup Folder	T1547.001
Defense Evasion	Obfuscated Files/Scripts	T1027
Command & Control	Application Layer Protocol	T1071.001
Collection	Clipboard Data	T1115
Discovery	System Information Discovery	T1082

Identified Malware

AsyncRAT

• Full-featured Remote Access Trojan (RAT)
• Communicates via svchost.exe to Russian C2 IP
• Capabilities: keylogging, webcam access, file upload/download, remote control

Emmenhtal (Loader)

• HTA-based loader linked to Lumma Stealer and CryptBot campaigns
• Behavior: HTA → PowerShell → binary drop
• Modifies %APPDATA%, %Startup%
• Uses silent output (cmd.exe >nul)

Network & Communication

Possible Attribution

According to TTPs identified by Check Point and Any.run, and based on the infrastructure used (e.g., .htaccess evasion, backup redirection, .hta loaders), as well as C2 communications to Russian IPs and the presence of AsyncRAT and Emmenhtal, attribution points to threat actors using tools commonly associated with Eastern European cybercriminal groups.

While attribution remains uncertain due to a lack of unique indicators, this campaign matches TTPs previously observed in clusters utilizing Lumma Stealer and widely-used RAT infrastructure.

Let’s not forget that Lumma is also a MaaS (Malware as a Service) as I often say in my talks, "good, pretty, and cheap"which means anyone can launch a massive campaign with it.

Conclusions

This type of campaign targeting the hotel industry is massive not just in Spain, but globally. It’s a sector that relies 99% on email and online bookings, making it highly exposed to such attacks.

Additionally, many hotel employees are seasonal, and there’s often not enough time to conduct proper cybersecurity training for each new hire.

However, from my contacts in the sector (CIOs and CISOs), I can confirm that more and more protection tools are being implemented, including:

• SASE to control access to malicious sites
• EDR to detect sophisticated malware
• And of course, email security to stop the attack at the entry point

Still, no security tool is more powerful than our own brain and common sense and that’s what we need to continuously feed with fresh threat indicators.

In the next post, I’ll share Phase Two: when the attacker already has everything and starts targeting us, the guests, who only wanted a few relaxing days at a hotel... but instead...

Remember: Share the blog. Knowledge is power.