Travelers targeted by phishing attacks using real booking data

Cybercriminals are conducting highly targeted phishing attacks against the travel and hospitality industry by using accurate reservation data. Fraudulent messages, sent via email and WhatsApp, include specific details such as guest names, travel dates, and accommodation specifics to appear legitimate. These messages often pressure recipients to click links to “confirm” bookings, which then leads to credential harvesting or malware installation.

In South Africa, tour operators reported receiving these messages, with some receiving over a dozen in a single day. The South African Travel and Tourism Association (SATSA) has issued warnings to its members. The compromised data appears to be linked to platforms using Semper, a South African property-management and reservation software provider. Semper’s CEO, Eben Marais, confirmed a data-related incident and stated that clients were alerted during the investigation.

Reports indicate that the attackers use the urgency of potential booking cancellations to trick victims into providing banking details or personal information through fake payment pages that mimic legitimate services.