Booking.com phishing scam is infecting users with malware by using lookalike URLs — don't fall for this

News
By published

Booking dot yikes

Booking.com logo on a smartphone in front of a screen of computer code
(Image credit: Shutterstock)

Booking.com is taking another hit this year thanks to a new phishing campaign that tricks users with lookalike characters to redirect them to malicious websites. Threat actors have been using a Japanese hiragana character – ん – because of its resemblance to a forward slash. At a quick glance, it makes a phishing URL appear legitimate.

Initially discovered by independent malware hunter and security researcher JAMESWT, the attack relies on a visual similarity between characters so that scammers can create URLs that will fool users who don’t inspect them closely. The text in the malicious emails resembles the actual booking.com web address too because it also abuses the Japanese hiragana character which can pass for a “/n” or “/~“ letter pattern.

Investigation and reporting from Bleeping Computer, shows that a similar campaign that uses a misspelling of Intuit is also being distributed – this one uses a lookalike domain that opts for an “L’ instead of the “I” in Intuit. The emails appear to come from, and take users to, an Intuit.com email address but have an intentionally narrowed view so that mobile users will be encouraged to click on “verify my email” without inspecting or checking the link.

Either way, the tactic here is to use a homoglyph in the phishing scheme – a character that looks similar to others but belongs to a different alphabet or character set. Visually similar characters can be – and often have been – exploited in phishing attacks and software developers will work to stay ahead by making it easier for users to distinguish between the distinct characters.

It’s always recommended for users to hover over a link to see where it will take you before clicking. Also, check the end of a domain before the backslash to check the registered domain. Given the homoglyphs similarities, this can be tricky, which is why it’s worthwhile to always have one of the best antivirus software solutions installed on your computer to protect you from any potential malware infections.

More from Tom's Guide

Amber Bouman
Amber Bouman
Senior Editor Security

Amber Bouman is the senior security editor at Tom's Guide where she writes about antivirus software, home security, identity theft and more. She has long had an interest in personal security, both online and off, and also has an appreciation for martial arts and edged weapons. With over two decades of experience working in tech journalism, Amber has written for a number of publications including PC World, Maximum PC, Tech Hive, and Engadget covering everything from smartphones to smart breast pumps. 

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.