Third-Party Impersonation Scam: What Every Property Needs to Know

As we continue to improve security awareness and resilience across our platform, we’d like to highlight another critical threat targeting the hospitality sector. Earlier last year, a campaign was impersonating Booking.com and delivering credential-stealing malware. This article explains what is happening, why it matters to you, and what you can do to protect your business.

What’s happening

A new phishing scam is targeting accommodation providers by pretending to be Booking.com. The emails look convincing and often claim there is an urgent issue with a guest review or your property listing.

If someone clicks the link, they are taken to a fake Booking.com page that asks them to run a command on their computer. If they do, malware is installed, giving attackers access to passwords, payment information, and other sensitive data.

This campaign is active across multiple regions, including Oceania, and specifically targets hospitality businesses such as hotels, motels, and holiday parks.

Why this is relevant for your property

If your property uses a PMS like ours and connects to online booking channels, you are part of the hospitality ecosystem that this campaign is targeting. Here’s why it matters:

Malware could steal passwords, payment information, or guest data, affecting your PMS, booking channels, and property operations.
Staff members may receive a legitimate-looking email, click a link, and accidentally trigger the malware.
Once inside, attackers may use stolen credentials to commit fraud, misdirect payments, or access sensitive guest or property data.
This scam tricks people into copying and running a command, so it can bypass normal security protections that usually stop standard phishing links.

In short: your property’s risk exposure can increase not just through your own systems, but via any third-party booking channel, partner, or staff email.

How the attack works

1. A staff member receives an email that appears to come from Booking.com. Examples: a guest review request, a complaint about a review, an account-verification alert.

Figure 1. Sample phishing email, purportedly requiring the recipient to address negative feedback about a hotel.

Third-Party Impersonation Scam: What Every Property Needs to Know - How the attack works figure 2 — Figure 2. Sample phishing email, purportedly requiring the recipient to verify their Booking.com account.

2. The email links to a webpage that looks like a Booking.com account verification page. The page shows a fake CAPTCHA prompt.

3. The user is instructed to press a keyboard shortcut, then paste and run a command (which the malicious webpage has placed into their clipboard). This command launches the malware.

4. Once installed, the malware can steal passwords, payment information, or give attackers remote access.

5. Attackers then use that access to commit fraud or further compromise your systems.

What you can do

Here are practical steps your property and staff should follow to reduce risk.

Enable MFA on all critical systems and email accounts.

Train staff to recognise phishing red flags:

Be cautious of urgent messages like “Your account will be suspended” or “Respond now.”
Watch for typos or misspelled domains (e.g., “seecom.com” or “micros0ft.com”)
Be wary of emails containing unexpected attachments.

Use email filtering and anti-phishing tools (e.g. Microsoft Defender).

Verify URLs before clicking – hover over links to check authenticity.

Run regular malware scans on all devices.

Monitor sign-in logs for unusual activity.

Why this matters for us at Seekom

At Seekom, we are committed not just to delivering great PMS software, but also to helping our partner properties protect their business and reputation. Phishing campaigns like this one (impersonating Booking.com) show that cybersecurity isn’t just an IT issue - it is a business and people issue.

A compromised staff account can affect property operations, revenue, guest experience, and even how you use our system or third-party channels. By educating staff, implementing strong controls, and staying vigilant, you can significantly reduce your risk.

Related case: business email compromise

For those of you who receive the HAPNZ monthly newsletter, you may have seen an article from AON Insurance about a professional services firm in New Zealand that suddenly faced a business email compromise targeting their administration/accounts manager. The threat actor gained unauthorised access to the business’s mailbox, resulting in a significant breach.

The breach was discovered when approximately 400 clients of the firm received emails with “overdue statements” containing altered bank information.

For those who haven’t seen it, you can read the full article here: How Cyber Insurance Saved This Small Business

Note: Something you may not know is that we also build websites. Many of our customers have Seekom-built, self managed websites with full control, backed by our expert setup and support. If you’re interested in finding out more, please get in touch.

Find out more

Get in touch

4/234 Wakefield Street, Te Aro, Wellington 6011
Phone (NZ) : +64 4 974 9588
Phone (UK) : +44 20 3835 5939
Support: support@seekom.com
Websites: webhelp@seekom.com

Connect With Us