You receive the electronic reservation? Malware attack poses as hotel booking email

Graham Cluley
Graham Cluley
@[email protected]

Bogus hotel reservation emails have been spammed out widely, which claim to come from but in reality carry malware designed to infect Windows computers.

Even if recipients haven’t booked a hotel room they might be tempted to open the dangerous attachments, in fear that their credit card has been charged.

Here’s what a typical malicious email looks like:

Malicious hotel booking email

The emails are not entirely convincing, as they use a subject line in somewhat broken English:

Subject: you receive the electronic reservation [random number] From:“” <[email protected]>
Attached file: Your electronic reservation ID[random].zip

Here’s another example, which claims that you have booked a vacation at the Mandarin Oriental hotel in London’s Hyde Park:

Nalicious hotel booking email

As you can see, the cybercriminals behind the campaign have attempted to make their attack harder to block by varying subject lines, attached filenames and the vacation details included in the body of the email.

For instance, a wide variety of hotel names are used in the bogus reservation emails. Here are just a handful of the names used:

  • Four Seasons Hotel
  • Mandarin Oriental Hyde Park
  • Shangri-La Hotel
  • Hotel Imperial
  • Mara Safari Club
  • The Sanctuary At Kiawah Island
  • Il San Pietro di Positano
  • Four Seasons Resort Maui at Wailea
  • Grand Hotel Timeo
  • Hotel Ritz-Carlton

If you do receive one of these emails, delete it from your inbox. The one thing you shouldn’t do is open the ZIP file and attempt to access the file contained within, as it is designed to infect your Windows computer.

Sophos security products detect the attack as both spam and malware (identifying the attachment proactively as Mal/DrodZp-A).

Sign up to our free newsletter.
Security news, advice, and tips.

Of course, this is far from the first time that malware authors have distributed their attack posing as a hotel booking, and it’s unlikely to be the last. The reason they use disguises like this is that the social engineering works so well at tricking people into clicking on the dangerous attachment or a malicious link.

It’s time to wise up, and tell your friends not to fall for such traps.

You should always be suspicious of email attachments that are sent to you out of the blue. Make sure that your anti-virus product is updated, that you have the latest security patches, and tell your friends to think twice before opening unknown attachments.

Stay safe folks.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.