Phishing Eager Travelers
Summary: Unit 42 analyzed travel-themed phishing URLs registered between October 2019 and August 2021 and found a gradual upward trend starting in early 2021, with a significant increase in June 2021 and registration throughout the summer well above any level seen in 2020. The report documents two real campaigns: Dridex malspam using travel-keyword domains such as animalairlines[.]org and soleravacation[.]net to deliver an installer and backdoor access, and phishing pages hosted on Google Firebase that targeted an online vacation rental marketplace, upscale hotel chains, resort management companies and airlines including Tui.
What's compelling: Firebase pages rode Google's own domain reputation past email filters, and the SITA passenger service system attack compromised 4.5 million global data subjects - so the travel data your organization holds is already a proven target for both state-linked and financially motivated actors.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026