✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Hospitality
Breach intelligence, attack campaigns, and threat reports targeting the Hospitality sector.
Explore Other Sectors
Hospitality Threat Reports
Hotel Wi-Fi Attacks Deploy Custom Malware to Compromise Microsoft 365 Accounts
In May 2026, Microsoft identified a sophisticated cyberattack campaign, dubbed 'CaptiveCrunch,' targeting hotel and conference center Wi-Fi networks globally. Attributed to the Russian state-sponsored group Midnight Blizzard (APT29), the attackers compromised captive portal equipment to manipulate DNS and HTTP traffic. This allowed them to redirect users to phishing pages mimicking Microsoft 365 login portals, leading to credential theft. Additionally, they deployed custom malware families, CornFlake and ChocoShell, enabling persistent access, surveillance, and data exfiltration. This incident underscores the evolving tactics of nation-state actors in exploiting trusted public networks to infiltrate corporate environments. The use of custom malware and advanced phishing techniques highlights the need for heightened vigilance and robust security measures when accessing corporate resources over public Wi-Fi.
5 days ago
Kill Chain
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
In July 2026, cybersecurity firm ReliaQuest identified a campaign where attackers compromised Wi-Fi devices in hotels and conference centers to hijack DNS settings. This manipulation redirected users attempting to access legitimate Microsoft 365 login pages to attacker-controlled phishing sites, leading to credential theft. The campaign, active since at least June 2026, affected various sectors, including financial services, healthcare, and retail, across multiple countries such as the U.S., India, and Saudi Arabia. The attackers exploited weakly protected management interfaces or unpatched vulnerabilities in Wi-Fi gateways to gain administrative access and alter DNS configurations. This method allowed them to intercept sensitive business information and communications without direct access to the victims' devices. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/?utm_source=openai)) This incident underscores the evolving tactics of threat actors, who are increasingly targeting network infrastructure to bypass traditional endpoint security measures. The use of DNS hijacking to facilitate adversary-in-the-middle attacks highlights the need for organizations to secure all network devices, including those in transient environments like hotels and conference centers. Implementing robust security practices, such as using always-on, full-tunnel VPNs and encrypted DNS, is crucial to mitigate such threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/?utm_source=openai))
2 weeks ago
Kill Chain
Critical Unpatched Flaw in Shark Vacuums Highlights IoT Security Risks
In July 2026, a critical security vulnerability was discovered in Shark RV2320EDUS robot vacuums, allowing attackers to remotely execute commands on other Shark vacuums within the same AWS region. By extracting the device certificate from the vacuum's flash storage, an attacker could gain root access to other devices, enabling actions such as controlling the vacuum's movements, accessing onboard cameras, retrieving home maps, and obtaining Wi-Fi credentials in plaintext. The flaw was reported to SharkNinja in March 2026 but remained unpatched as of the disclosure. This incident underscores the escalating risks associated with IoT devices, particularly those with inadequate security configurations. The ability to exploit a single device to compromise an entire network of similar devices highlights the urgent need for robust security measures in IoT device design and deployment.
3 weeks ago
Kill Chain
DigitalMint Negotiator's Betrayal: A Wake-Up Call for Cybersecurity
In 2023, Angelo Martino, a ransomware negotiator at DigitalMint, exploited his position by sharing confidential client information with the BlackCat/ALPHV ransomware group. This betrayal enabled the attackers to extort a total of $75.3 million from five U.S. companies. Martino's actions included disclosing victims' negotiation strategies and insurance details, thereby maximizing ransom demands. In July 2026, he was sentenced to 70 months in prison for his role in these conspiracies. This case underscores the critical importance of trust and integrity within cybersecurity roles. The incident highlights the potential risks posed by insider threats and the necessity for organizations to implement stringent oversight and monitoring mechanisms to safeguard sensitive information.
1 month ago
Kill Chain
Alleged Scattered Spider Hacker Extradited to the United States
In April 2026, 19-year-old Peter Stokes, a dual U.S.-Estonian citizen, was arrested in Finland and extradited to the United States to face charges of conspiracy, computer intrusion, and fraud. Stokes is alleged to be a member of the Scattered Spider hacking group, implicated in over 100 network intrusions resulting in more than $100 million in ransom payments and significant operational disruptions. Notably, in May 2025, the group targeted a luxury item retailer, demanding an $8 million ransom after stealing 100 gigabytes of data. The company refused to pay but incurred over $2 million in losses due to operational disruptions and remediation efforts. ([justice.gov](https://www.justice.gov/opa/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and-extradited?utm_source=openai)) This incident underscores the persistent threat posed by cybercriminal groups like Scattered Spider, known for sophisticated social engineering tactics and targeting high-profile organizations. The arrest highlights ongoing international efforts to combat cybercrime and the importance of robust cybersecurity measures to protect against such threats.
1 month ago
Kill Chain
Persistent Phishing Threats in the Hospitality Industry: A 2026 Case Study
In April 2026, a sophisticated phishing campaign targeted hospitality organizations across Europe and Asia. Attackers impersonated guests, sending emails with malicious ZIP files disguised as photo attachments. These emails exploited trusted services like Calendly and Google redirects to bypass email authentication checks. Upon opening the ZIP files, victims inadvertently executed a PowerShell script that installed a persistent Node.js-based malware implant, granting attackers long-term access to compromised systems. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs?utm_source=openai)) This incident underscores a growing trend of cybercriminals leveraging social engineering and trusted platforms to infiltrate organizations. The use of advanced techniques, such as 'authentication laundering' and blockchain-based command-and-control mechanisms, highlights the evolving nature of cyber threats in the hospitality sector. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs?utm_source=openai))
1 month ago
Kill Chain
Microsoft Alerts Hospitality Sector to Advanced Phishing Threat
Since April 2026, a sophisticated phishing campaign has been targeting hotel and hospitality organizations across Europe and Asia. Attackers send emails impersonating 'Booking Manager (via Calendly)' with subjects referencing guest complaints or health inspections. These emails contain links leading to ZIP files named 'photo-<numbers>.zip,' which, when opened, execute a Node.js-based remote access trojan (RAT) called TonRAT. The malware establishes command-and-control channels through the TON blockchain API, complicating detection and mitigation efforts. This incident underscores the evolving tactics of cybercriminals who exploit trusted platforms like Calendly and Google’s URL redirect services to bypass traditional email security measures. The use of Node.js implants and blockchain-based command-and-control mechanisms highlights the need for organizations to enhance their cybersecurity defenses against increasingly sophisticated phishing campaigns.
1 month ago
Kill Chain
Unveiling the Cybersecurity Challenges of the 2026 FIFA World Cup
The 2026 FIFA World Cup, spanning 16 cities across the United States, Canada, and Mexico, has become a prime target for cybercriminals exploiting its vast digital infrastructure. Since January 2026, approximately 19,000 domains containing 'fifa' have been registered, many of which are used for phishing campaigns aimed at stealing personal and financial information from fans seeking tickets and merchandise. Additionally, state-sponsored actors have been implicated in sophisticated cyberattacks, including claims by the Iran-linked group Handala of breaching FBI drone surveillance systems, potentially compromising security measures at the event. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/08/fifa-world-cup-cyber-threats/?utm_source=openai)) The convergence of cyber and physical threats during the tournament underscores the need for comprehensive security strategies. The expansive attack surface, encompassing ticketing portals, transportation networks, and stadium IoT systems, requires proactive threat intelligence and real-time monitoring to mitigate risks. Organizations involved must ensure coordination across digital and physical domains to maintain operational stability throughout the event. ([intel471.com](https://www.intel471.com/resources/whitepapers/fifa-2026-world-cup-top-cyber-threats?utm_source=openai))
1 month ago
Kill Chain
Meta AI Support Exploit Leads to Massive Instagram Account Hijack
In May 2026, attackers exploited a vulnerability in Meta's AI-powered High Touch Support (HTS) system to hijack over 20,000 Instagram accounts. The flaw allowed unauthorized individuals to request password reset links be sent to email addresses not associated with the target accounts, bypassing standard verification processes. This oversight enabled attackers to reset passwords and gain control of accounts lacking two-factor authentication (2FA). High-profile accounts, including those of former President Barack Obama and the U.S. Space Force, were among those compromised. Meta has since patched the vulnerability and is working to secure affected accounts. This incident underscores the risks associated with deploying AI-driven support systems without robust security measures. It highlights the necessity for continuous monitoring and validation of AI functionalities to prevent exploitation. Organizations are urged to implement comprehensive security protocols, including mandatory 2FA, to mitigate similar threats in the future.
2 months ago
Kill Chain
Cybersecurity Challenges Facing the 2026 FIFA World Cup
As the 2026 FIFA World Cup approaches, cybercriminals are intensifying efforts to exploit the event's global prominence. Recent reports indicate a surge in phishing campaigns, with over 4,300 fraudulent domains mimicking FIFA's official website to deceive fans into providing personal and financial information. Additionally, state-sponsored actors are anticipated to target tournament infrastructure, aiming to disrupt operations and gather intelligence. These activities pose significant risks to fans, organizations, and the integrity of the event. The current landscape underscores the evolving nature of cyber threats associated with major global events. The proliferation of AI-generated content and deepfake technologies has enabled more sophisticated phishing and social engineering attacks. Organizations involved in the World Cup must enhance their cybersecurity measures to mitigate these risks and protect stakeholders from potential breaches and fraud.
2 months ago
Kill Chain
Carnival Cruise Data Breach 2026: A Wake-Up Call for Cybersecurity
In April 2026, Carnival Corporation, the world's largest cruise line operator, experienced a significant data breach affecting nearly 6 million individuals. The breach was initiated through a social engineering attack, where an unauthorized actor deceived an employee to gain access to a limited portion of the company's IT system. The attackers, identified as the ShinyHunters extortion gang, claimed responsibility for the breach, stating they stole documents containing over 8.7 million records with personally identifiable information and terabytes of internal corporate data. The compromised data includes names, dates of birth, email addresses, genders, geographic locations, and loyalty program details. Carnival promptly blocked the unauthorized activity and began working with third-party security experts to strengthen their security measures and conduct a thorough investigation. This incident underscores the persistent threat posed by sophisticated cybercriminal groups like ShinyHunters, who employ advanced social engineering tactics to infiltrate organizations. The breach highlights the critical need for robust cybersecurity protocols, employee training to recognize and resist social engineering attempts, and comprehensive incident response strategies to mitigate the impact of such attacks.
2 months ago
Kill Chain
FBI Issues Warning on Fake FIFA Websites Targeting 2026 World Cup Fans
In May 2026, the FBI issued a warning about cybercriminals creating fake websites impersonating FIFA ahead of the 2026 World Cup. These fraudulent sites, often with minor spelling variations or alternative top-level domains, aim to steal personal and financial information, sell counterfeit tickets, and perpetrate other scams. The threat actors employ techniques like typo squatting to deceive users into believing they are interacting with legitimate FIFA platforms. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260527?utm_source=openai)) This incident underscores the increasing sophistication of phishing and social engineering attacks targeting major global events. As the World Cup approaches, the prevalence of such scams is expected to rise, highlighting the need for heightened vigilance and robust cybersecurity measures among fans and organizations involved. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-warns-of-fake-fifa-websites-running-world-cup-fraud-schemes/amp/?utm_source=openai))
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports