Booking.com phishing scam is infecting users with malware by using lookalike URLs — don't fall for this

Booking.com is taking another hit this year thanks to a new phishing campaign that tricks users with lookalike characters to redirect them to malicious websites. Threat actors have been using a Japanese hiragana character – ん – because of its resemblance to a forward slash. At a quick glance, it makes a phishing URL appear legitimate.

Initially discovered by independent malware hunter and security researcher JAMESWT, the attack relies on a visual similarity between characters so that scammers can create URLs that will fool users who don’t inspect them closely. The text in the malicious emails resembles the actual booking.com web address too because it also abuses the Japanese hiragana character which can pass for a “/n” or “/~“ letter pattern.

While the text in the malicious emails resembles a booking.com address the hyperlink points to a URL that contains the hiragana character. When a user looks at the address in a web browser, the characters can look more like a subdirectory web address. However, victims tricked into clicking the link are sent to a malicious MSI installer which is used to drop further payloads which could include things like infostealing malware or remote access trojans.

Investigation and reporting from Bleeping Computer, shows that a similar campaign that uses a misspelling of Intuit is also being distributed – this one uses a lookalike domain that opts for an “L’ instead of the “I” in Intuit. The emails appear to come from, and take users to, an Intuit.com email address but have an intentionally narrowed view so that mobile users will be encouraged to click on “verify my email” without inspecting or checking the link.

Either way, the tactic here is to use a homoglyph in the phishing scheme – a character that looks similar to others but belongs to a different alphabet or character set. Visually similar characters can be – and often have been – exploited in phishing attacks and software developers will work to stay ahead by making it easier for users to distinguish between the distinct characters.

It’s always recommended for users to hover over a link to see where it will take you before clicking. Also, check the end of a domain before the backslash to check the registered domain. Given the homoglyphs similarities, this can be tricky, which is why it’s worthwhile to always have one of the best antivirus software solutions installed on your computer to protect you from any potential malware infections.

Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.

More from Tom's Guide

• 7 easy changes I made that drastically improved my digital security
• AT&T agrees to $177 million data breach settlement — here's how to file a claim
• How to track your kids screen time — and the best tools to do it