Phishing Campaign Exploits Ads to Breach Hotel Property Management Systems

Cybersecurity: Malvertising Campaign Targets Hospitality Sector

A recent malvertising campaign has been identified, targeting professionals in the hospitality industry by impersonating established service providers.

According to Okta Threat Intelligence, attackers have utilized malicious search engine advertisements, especially on Google Search, to mislead hospitality professionals into accessing counterfeit login portals. These efforts aim to collect credentials for cloud-based property management and guest messaging platforms.

Commencing in mid-2025, researchers noted that attackers were purchasing sponsored ad placements for at least thirteen reputable technology vendors within the hospitality and vacation rental sectors. These ads directed users to domains resembling legitimate URLs via typosquatting.

Upon accessing these deceptive sites, users are presented with authentic-looking login pages that request corporate email, password, and phone number.

Oracle Hospitality was one of numerous service providers impersonated .

The malicious ads are positioned above genuine vendor domains in search results, exploiting the tendency of users to click on top links.

Oracle Hospitality is among the targeted vendors, with attackers creating phishing domains mimicking Oracle’s branding.

The campaign's initial phase focuses on harvesting credentials. Fake login forms are designed to capture both standard account details and multi-factor authentication (MFA) codes.

Some phishing pages explicitly request a "One-time password," while others provide options to "Sign in with SMS Code" or "Email Code" after password submission.

Screenshot of a phishing website impersonating Airbnb .

Victims entering their phone numbers are then asked to provide one-time SMS codes, enabling attackers to bypass MFA protections.

Analysis of the phishing sites’ source code uncovered a JavaScript beaconing function:

<script> function sendRequest() { fetch("/mksd95jld43").catch(error => console.error("Ошибка запроса:", error)); } // Запускаем запрос каждые 10 секунд setInterval(sendRequest, 10000); </script>

The presence of Russian-language error messages and comments suggests possible involvement of Russian-speaking threat actors. Okta has also observed the use of a Russian datacenter proxy provider during sign-in attempts.

Beaconing for Real-Time Victim Analytics

The phishing pages employ beaconing techniques to gather real-time analytics on victims, including:

Visitor metrics and session duration Geolocation details Bot-activity detection Status monitoring for phishing-page uptime

This data allows attackers to refine social engineering tactics, target specific geographies, and ensure phishing pages remain undetected by automated defenses. At least a dozen hospitality technology providers have been impersonated. Compromising these accounts can lead to unauthorized access to reservations, guest data, and financial information.

Okta recommends the following controls for affected organizations and their partners:

Implement strong, possession-based authenticators like passkeys (FIDO2/WebAuthn), Okta FastPass, or smart cards. Enforce phishing-resistance policies for high-risk applications. Adaptive Risk Assessments

Require elevated authentication for access attempts from unfamiliar IP ranges or geographies. Automate anomaly detection to flag deviations in user activity. Domain Monitoring and Takedowns

Continuously monitor for suspicious domain registrations mimicking your brand. Issue takedown requests for intellectual property infringement. User Awareness and Notifications

Alert users to emerging malvertising threats. Notify users of suspicious login attempts or credential-phishing activity on their accounts.

Based on reporting by GBHackers.