Sometime slash might be Unicode Hiragana

Cybercriminals Exploit Unicode Trick to Mimic Booking.com in Phishing Scam

Threat actors have launched a new phishing campaign targeting Booking.com users, leveraging Unicode characters to disguise malicious links as legitimate ones. This attack shows how easily scammers can trick people with subtle visual deceptions.

How the Attack Works

The campaign uses the Japanese hiragana character “ん” (Unicode U+3093) inside phishing URLs. On some systems and fonts, this symbol looks like a forward slash (/) or part of a subdirectory, making the fake URL appear genuine.

For example, a phishing email may display the link (appears safe but is deceptive):

https://admin.booking.com/hotel/hoteladmin/...

But the actual malicious hyperlink is different (neutralized below for safety):

https://account.booking.comんdetailんrestric-access.www-account-booking[.]com/en/

At first glance, it looks like a real Booking.com page. In reality, the true registered domain is “www-account-booking[.]com”, not booking.com. Everything before that is just a deceptive string.

The Payload

Clicking the link leads victims to a malicious site that delivers a malicious MSI installer hosted on a CDN (neutralized for safety):

hxxps://updatessoftware.b-cdn[.]net/john/pr/04.08/IYTDTGTF.msi

When executed, the installer can drop additional payloads such as information-stealing malware or remote access trojans (RATs), giving attackers access to the victim’s device.

Samples of this attack have been shared on MalwareBazaar and analyzed using any.run, confirming the infection chain.

Why Homoglyph Attacks Work

This technique is part of homoglyph (or homograph) attacks, where characters from other alphabets look almost identical to Latin ones.

For example:

• Cyrillic “О” (U+041E) looks the same as Latin “O” (U+004F).

The use of “ん” is another example, exploiting typography and human error to trick users into trusting malicious links.

Previous Booking.com Phishing Campaigns

This isn’t the first time attackers have abused Booking.com:

• In March 2024, Microsoft warned about phishing campaigns targeting hospitality workers with malware-laced emails posing as Booking.com.
• In 2023, Akamai reported hotel guests being redirected to fake Booking.com pages to steal credit card details.

The latest campaign proves that Booking.com remains a lucrative target for cybercriminals.

How to Protect Yourself

Here are key steps to defend against homoglyph phishing:

• Check the domain name carefully — the real domain is the part just before the first /.
• Hover over links before clicking to reveal their actual destination.
• Be extra cautious on mobile devices, where limited screen space makes spotting fake domains harder.
• Keep security software updated, since many phishing kits deliver malware immediately after a click.

Final Thoughts

This Unicode-based phishing campaign highlights how attackers exploit tiny details to fool even careful users. As cybercriminals grow more inventive, vigilance is essential. A single deceptive character can turn a trusted site like Booking.com into a dangerous trap.