The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Hospitality
Breach intelligence, attack campaigns, and threat reports targeting the Hospitality sector.
Explore Other Sectors
Hospitality Threat Reports
DCRat Delivered Through Fake Booking Emails Hits European Hotels in 2026
In early 2026, a sophisticated cyberattack campaign, tracked as PHALT#BLYX, targeted the European hospitality sector using malicious fake booking emails. These emails redirected recipients to fraudulent Blue Screen of Death (BSoD) pages, pressuring hotel staff to install fake fixes. This social engineering technique resulted in the deployment of DCRat, a remote access trojan capable of stealing sensitive data, harvesting credentials, and providing attackers with persistent network access. The campaign, reported by Securonix, underscores the increasing professionalization of phishing lures and multi-stage malware delivery aimed at high-turnover verticals like hospitality. The attack highlights a recent trend of leveraging socially engineered booking-themed lures paired with malware disguised as system utilities. As similar TTPs proliferate and more malware-as-a-service tools become accessible, such incidents foreshadow growing risks for sectors with transient workforces and limited security training.
8 months ago
Kill Chain
Inside the ClickFix Campaign: How Hospitality Firms Were Hit with DCRat Remote Access Attacks
In early 2024, a sophisticated phishing campaign known as 'ClickFix' targeted organizations in the hospitality sector with convincing fake 'Blue Screen of Death' error messages. Attackers leveraged social engineering techniques combined with a legitimate Microsoft utility to trick victims into executing malicious payloads. Once engaged, the attack delivered the DCRat remote access trojan, granting cybercriminals ongoing access and control over affected systems. The campaign demonstrated how legitimate tools and realistic lures can bypass conventional defenses, resulting in compromised credentials, lateral network movement, and potential data exfiltration. This incident reflects a wider trend of threat actors increasingly turning to legitimate software and advanced social engineering to evade detection. Remote access trojans like DCRat continue to be used in targeted attacks, particularly against sectors with complex digital footprints and limited security controls, making it vital for organizations to adapt their threat detection capabilities.
8 months ago
Kill Chain
Inside the ClickFix Hospitality Attack: How Fake BSOD Screens Delivered Malware in Europe
In early 2024, a social engineering campaign dubbed 'ClickFix' targeted hospitality sector organizations across Europe by deploying convincing fake Windows Blue Screen of Death (BSOD) screens. Threat actors lured hotel staff into believing their systems were compromised, instructing them to download and execute what appeared to be legitimate fixes. Instead, victims manually compiled and ran malware, granting attackers access to sensitive information and operational networks. The campaign highlights how attackers combine psychological manipulation with technical tactics to bypass traditional security and leverage low-privilege endpoints for initial access, risking data loss and downstream attacks on partners. This incident signals a shift toward increasingly sophisticated social engineering and blended attack methods targeting industries with high customer throughput. As phishing tactics evolve, organizations must bolster employee awareness and deploy proactive threat detection to counter these multifaceted threats.
8 months ago
Kill Chain
Johnson Controls IoT Devices Exposed: 2025 Encryption Vulnerabilities in PowerG, IQPanel & IQHub
In December 2025, security researchers at NCC Group identified and responsibly disclosed four cryptographic vulnerabilities (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) impacting Johnson Controls’ PowerG, IQPanel, and IQHub products. The flaws included cleartext transmission of sensitive information, nonce reuse, weak pseudo-random number generation, and inadequate origin validation. Threat actors could exploit these issues to intercept, decrypt, or manipulate encrypted wireless traffic, potentially altering system behavior or disrupting services in commercial facilities globally. Johnson Controls issued advisories and firmware updates, especially urging customers to migrate to IQPanel 4 with firmware 4.6.1 or later. The incident highlights the continued importance of secure-by-design principles in IoT and OT devices, as attacks increasingly pivot toward embedded and building automation systems. Heightened regulatory focus and attacker sophistication underscore the need for proactive vulnerability management and segmenting critical infrastructure networks.
8 months ago
Kill Chain
LockBit Ransomware: Why Reputation Now Drives RaaS Attacks and Ransom Payments (2025 Analysis)
In early 2025, research into the LockBit ransomware-as-a-service (RaaS) gang revealed the pivotal role of reputation in both attacker and victim circles. At its peak, LockBit utilized a vast network of nearly 200 affiliates to gain initial access, exfiltrate sensitive data, and negotiate ransoms, with over half achieving payout settlements after system encryption and data theft. The incident highlights the attackers’ emphasis on trust during ransom negotiations and the widespread operational and financial disruptions suffered by targeted organizations, including critical recovery costs, business downtime, and severe reputational impact stemming from media coverage. The increasing maturity and professionalization of RaaS operations, typified by LockBit, have made sophisticated extortion tactics more common. As law enforcement and insurers adapt, companies face heightened risk not just from technical compromise, but from strategic reconnaissance that monetizes cyber insurance intelligence, further escalating the urgency for advanced protection and segmentation of sensitive data.
8 months ago
Kill Chain
Inside the 2024 Korea IP Camera Mass-Hack: A Wake-Up Call for IoT Security
In early 2024, South Korean authorities arrested four suspects for hacking into more than 120,000 IP cameras nationwide, exfiltrating sensitive video footage, and distributing it through a foreign adult website. Attackers exploited insecure and poorly configured IoT camera devices lacking adequate network segmentation or encrypted traffic, allowing for remote access and large-scale unauthorized surveillance. The breach exposed thousands of individuals to privacy violations and highlighted severe weaknesses in the deployment and security of IoT devices within residential and business environments. This incident underscores a rising trend of IoT device exploitation for privacy invasions, raising alarms globally about insufficient network protections and the urgency for robust segmentation, encrypted communications, and egress security policies as IoT adoption grows.
8 months ago
Kill Chain
Australia 2024 Airport Evil Twin WiFi Attack: Network Intrusion Threat Exposed
In 2024, Australian authorities sentenced a 44-year-old man to over seven years in prison for orchestrating a series of 'evil twin' WiFi attacks at major Australian airports. The perpetrator set up rogue wireless networks mimicking legitimate airport WiFi, luring unsuspecting travelers into connecting and unknowingly handing over sensitive data, including credentials and personal information. Over a prolonged period, these attacks evaded detection due to the sophistication of the deceptive access points and inherent insecurity of public wireless networks. The incident highlighted significant risks for both individuals and organizations, demonstrating effective tactics for harvesting credentials in the wild. This case exemplifies a broader trend of attackers exploiting public and unsecured networks to launch network intrusion campaigns, especially as remote work and mobile connectivity surge. Such methods bypass conventional perimeter defenses and increase compliance and regulatory pressures for organizations to protect data in transit.
8 months ago
Kill Chain
2024 Uhale Android Photo Frame Breach: Supply Chain Malware Risk
In mid-2024, security researchers discovered that popular Uhale-branded Android-based digital photo frames were shipping with critical security flaws, including a supply chain compromise whereby the devices automatically downloaded and executed malware upon boot. The attack exploited insecure system components and unauthorized code injection, allowing threat actors to remotely install and run arbitrary malware. As a result, affected users faced risks ranging from credential theft and device hijacking to involuntary participation in botnets, with downstream exposure to broader enterprise or home networks if connected. This incident comes amid a broader surge in supply chain attacks targeting IoT and smart devices, with attackers leveraging manufacturer or third-party vulnerabilities to pre-install malware before devices reach consumers. The event highlights the growing regulatory and operational scrutiny of supply chain security, emphasizing the urgent need for enhanced vendor risk management and enterprise device segmentation.
8 months ago
Kill Chain
Russian Hackers Create 4,300 Fake Travel Sites to Phish Hotel Guests
In early 2025, a Russian-speaking threat group orchestrated a widespread phishing campaign targeting the hospitality sector by registering over 4,300 fraudulent travel and hotel websites. Posing as legitimate booking platforms, the attackers lured hotel guests via persuasive spam emails, harvesting sensitive payment data and personal information from unsuspecting travelers. The threat actor leveraged sophisticated domain registration strategies and rapid site turnover to evade detection, resulting in a significant exposure of financial data and reputational harm to both guests and affected hospitality brands. This incident signals an ongoing trend of highly targeted phishing operations in the travel industry, exploiting the surge in online bookings and trust in familiar brand identities. The campaign underscores the critical need for advanced threat detection, greater scrutiny of online domains, and robust security awareness for organizations and their customers.
8 months ago
Kill Chain
ClickFix Phishing Hits Hospitality: Hotel Credentials Compromised via PureRAT
In late 2025, the hospitality sector was targeted by a sophisticated, large-scale phishing campaign involving ClickFix-style lures that tricked hotel managers into revealing their credentials. Attackers leveraged compromised email accounts to distribute malicious links to numerous hotel establishments, leading victims to phishing sites that mimicked familiar workflow tools. Credential theft enabled deployment of PureRAT malware, which provided remote access to internal hotel systems and enabled lateral movement, resulting in compromised operations and data exposure for multiple organizations. This incident demonstrates the increasing use of advanced social engineering in credential-focused attacks against the hospitality industry. With phishing campaigns growing more convincing and commodity RATs like PureRAT widely available, organizations in high-turnover sectors face mounting risk from credential-based breaches and follow-on malware infections.
8 months ago
Kill Chain
ClickFix Hospitality Breach: Infostealer Attack Impacts Hotels and Their Customers
In early 2024, a cybercrime campaign known as "ClickFix" targeted hospitality providers globally using infostealer and remote access trojan (RAT) malware. Threat actors gained initial access via spear phishing and malicious links, compromising hotel systems to harvest sensitive booking data and customer contact information. Attackers leveraged this stolen data to conduct highly convincing secondary phishing attacks directed at hotel customers via both email and WhatsApp channels, exposing guests to social engineering, fraud, and further credential theft. This cascading impact emphasized the attacker's focus on exploiting trusted relationships across business and customer environments. The incident is notable for its dual-target strategy, harnessing a single breach to fuel broader downstream attacks and demonstrating attackers' sophisticated use of layered social engineering. As infostealer activity surges across the hospitality and service sectors, defenders must adapt to increasingly persistent, multi-stage campaigns that pose risks for both enterprise operations and their customers.
8 months ago
Kill Chain
Ubia Ubox IoT Cameras Exposed: 2025 Credential Vulnerability Risks
In November 2025, a critical vulnerability (CVE-2025-12636) was disclosed in Ubia's Ubox smart camera platform, affecting version 1.1.124. The issue—insufficiently protected credentials—enables a remote attacker with low complexity to exploit API credential weaknesses, providing unauthorized access to live camera feeds and the ability to modify device settings. No public exploitation has yet been reported, but the vulnerability impacts commercial facilities worldwide, especially enterprises deploying these IoT cameras without network segmentation or backend isolation. Ubia did not engage with CISA coordination efforts. This incident exemplifies the ongoing risks associated with insecure IoT/ICS deployments and the lack of vendor responsiveness. With increased regulatory scrutiny and attacker interest in operational technology, ensuring proper credential management and network segmentation is an urgent priority for organizations using connected surveillance systems.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports