You receive the electronic reservation? Malware attack poses as hotel booking email

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Bogus hotel reservation emails have been spammed out widely, which claim to come from Booking.com but in reality carry malware designed to infect Windows computers.

Even if recipients haven't booked a hotel room they might be tempted to open the dangerous attachments, in fear that their credit card has been charged.

Here's what a typical malicious email looks like:

The emails are not entirely convincing, as they use a subject line in somewhat broken English:

Subject:
you receive the electronic reservation [random number]
From:
"Booking.com"
Attached file:
Your electronic reservation ID[random].zip

Here's another example, which claims that you have booked a vacation at the Mandarin Oriental hotel in London's Hyde Park:

As you can see, the cybercriminals behind the campaign have attempted to make their attack harder to block by varying subject lines, attached filenames and the vacation details included in the body of the email.

For instance, a wide variety of hotel names are used in the bogus reservation emails. Here are just a handful of the names used:

Four Seasons HotelMandarin Oriental Hyde ParkShangri-La HotelHotel ImperialMara Safari ClubThe Sanctuary At Kiawah IslandIl San Pietro di PositanoFour Seasons Resort Maui at WaileaGrand Hotel TimeoHotel Ritz-Carlton

If you do receive one of these emails, delete it from your inbox. The one thing you shouldn't do is open the ZIP file and attempt to access the file contained within, as it is designed to infect your Windows computer.

Sophos security products detect the attack as both spam and malware (identifying the attachment proactively as Mal/DrodZp-A).

Of course, this is far from the first time that malware authors have distributed their attack posing as a hotel booking, and it's unlikely to be the last. The reason they use disguises like this is that the social engineering works so well at tricking people into clicking on the dangerous attachment or a malicious link.

It's time to wise up, and tell your friends not to fool for such traps.

You should always be suspicious of email attachments that are sent to you out of the blue. Make sure that your anti-virus product is updated, that you have the latest security patches, and tell your friends to think twice before opening unknown attachments.

Stay safe folks.

Follow @gcluley

View the original article here