Explanation
The goal of this Booking-related phishing campaign is to obtain credit card information.
The malicious email claims the recipient is entitled to cashback due to a successful verification. The message includes a (personalized) alleged cashback code with the format ‘CBKXXXX’. If the user clicks the ‘Redeem now & verify’ button, they are redirected through several redirects to the malicious phishing landing page. Hereby, it’s possible that a Captcha needs to be completed beforehand, although this isn’t directly part of the phishing attempt itself.
On the actual phishing page, users are first asked to enter their email address and the cashback code from the email. Randomly chosen, non-existent codes will not be accepted here. After a brief verification, the user lands on a second page where they are prompted for their card credentials. There appears to be an option to select ‘Bank Transfer’ as well, however you are immediately redirected back to the ‘Credit Card’ section.
Upon submitting the data, a fake loading page pretends to establish a connection with Booking, but ultimately ends in an alleged error.
All the previously described steps take place on pages under the malicious domain ‘bondcharters.vps-isos[.]com’ .
Example
