Booking.com phishing scam is infecting users with malware by using lookalike URLs — don’t fall for this

Booking.com is taking another hit this year thanks to a new phishing campaign that tricks users with lookalike characters to redirect them to malicious websites. Threat actors have been using a Japanese hiragana character – ん – because of its resemblance to a forward slash. At a quick glance, it makes a phishing URL appear legitimate.

Initially discovered by independent malware hunter and security researcher JAMESWT, the attack relies on a visual similarity between characters so that scammers can create URLs that will fool users who don’t inspect them closely. The text in the malicious emails resembles the actual booking.com web address too because it also abuses the Japanese hiragana character which can pass for a “/n” or “/~“ letter pattern.