{"success":true,"data":{"id":"fake-hotel-booking-guest-payment-reverification-phish","label":"Fake Booking.com guest payment re-verification phishing — abuses hacked hotel Booking.com accounts to send payment-reverification requests from the legitimate booking.com domain, directing to a fraudulent card-entry page with reservation-cancellation urgency. NCA / Booking.com advisory 2025-2026; Abnormal Security hospitality-phish Q1 2026.","description":"Phishing attack exploiting hacked hotel Booking.com accounts — attacker sends payment-re-verification requests from the legitimate booking.com domain directing guests to off-domain card-entry pages with reservation-cancellation urgency. Distinct from host-side hospitality phishing: targets GUESTS not hosts. Three-part detection: (1) sender on booking.com, (2) re-verify-payment / re-enter-card / update-payment-method urgency, (3) off-booking.com link, no In-Reply-To. NCA / Booking.com advisory 2025-2026; Abnormal Security hospitality-phish Q1 2026.","tier":"danger","category":"phishing","isThin":false}}