“One post last month on the Russian-language hacking forum BHF offered up to $5,000 for each hotel account.”
A traveler got a phishing message inside the Booking app minutes after reserving a California hotel, complete with real reservation details. Booking.com says its own systems were never compromised and blames malware on partners’ machines. It says 2FA is required but won’t say whether that covers every partner. The email address behind the fake site registered more than 700 phishing domains in one month.