Cybercriminals are impersonating Booking.com in email campaigns designed to infect hospitality staff with malware, using fake "blue screen of death" pages as part of the infection chain, Help Net Security reports.

The scheme targets the people who run the property side of the booking business, not the guests. Attackers send messages that look like routine Booking.com correspondence — the kind of notification a front-desk agent or reservations manager opens dozens of times a day. Once the recipient engages, the campaign deploys a fabricated Windows crash screen, better known as a BSOD, to move the attack forward.

Why hospitality?

Hotel and restaurant staff sit on a tempting pile of data: guest names, payment details, booking histories, and property-side platform credentials. A single compromised inbox at a front desk can expose months of reservations. Booking.com connects hundreds of thousands of properties worldwide, which means one convincing email template scales across an entire industry.

The fake BSOD trick matters because it manufactures urgency. A crash screen tells an employee something is broken right now, and broken systems get fixed fast — often without a call to IT first. That urgency is the mechanism the attackers are counting on.

What does this change for operators?

For hoteliers and restaurant groups, the practical takeaway is training. Staff who handle third-party booking platforms should treat unexpected emails — even ones that look like Booking.com — as unverified until checked. A crash screen appearing after opening an attachment or link is not a Windows problem; it's a phishing signal.

Operators should also separate duties: reservations staff shouldn't need administrative rights on their machines, so malware that lands on one workstation can't spread or escalate. Multi-factor authentication on booking platform accounts adds a second lock on the credentials attackers actually want.

The campaign is a reminder that hospitality's security weak point is rarely the technology itself. It's the inbox of a busy employee during check-in season, and the attackers have clearly studied that workflow.