Cybercrooks book a stay in hotel email inboxes to trick staff into spilling credentials Cybercriminals are preying on the inherent helpfulness of hotel staff during the sector's busy holiday season. Researchers at Sophos said the latest malware campaign targeting hotels involves sending emails that play on the emotions of staff, while at the same time applying time pressure, to trick them into downloading and …
Auto reply to all complaint emails à la Basil Fawlty:
"You ponce in here expecting to be waited on hand and foot, while I'm trying to run a hotel here. Have you any idea of how much there is to do? Do you ever think of that? Of course not, you're all too busy sticking your noses into every corner, poking around for things to complain about, aren't you?"
Even the pointy-haired ones can see that's a silly idea that is still exploitable.
1) text based bogus writ threats will still get through
2) socially engineer the recipient to reassemble the link - which is a variation of these password-protected droppers that are making a comeback.
I'm missing a step in the exploit chain here. Once the staff member downloads the google drive file, it wouldn't be automatically installed. I'm assuming the file is a .exe executable? Are the hotel staff double clicking it and clicking Yes on the UAC prompt?
You'd have thought with all that AI that Gurgle could scan stuff that people put on Gurgle Drive with some kind of, like, well, a malware scanner.
I see dozens of links to Gurgle Drive in emails every day. They're all from criminals and they all link to malware.
Any email that arrives here with Gurgle Drive links in it is automatically reported to a dozen different DNSBLs.
I've never seen Gurgle Drive used legitimately.
I'm hoping it will go the way of most other Gurgle flashes in the pan.
"I see dozens of links to Gurgle Drive in emails every day. They're all from criminals and they all link to malware."
I work with a lot of real estate agents and they just love Google for free services. I keep trying to tell them that a gMail account and anything else Google screams cheap and nothing but a hobbiest. Google Drive accounts are free and simple to set up without any checks so they are perfect for scammers. They don't have to persist long to do their job so if Google does find out they're driving the get-away car, it's too late.
The major scam with booking.com is that the scammers insert messages directly into the chat stream of your booking. Asking for a cash transfer, since your card "didn't go through". Bank account details for the transfer are always included. This is a 5 year old scam on booking.com and a perennial on chat forums. When will this platform have the wit to block anything that looks like a payment request with bank transfer details?
which leads to the download of a digitally signed executable.
Its comforting that this is still the favorite method , that training and OS/ browser warnings and user admin rights should be able to keep in check.
I know there will always be people who are fooled but jeeeesus: it couldnt be any simpler could it ?
"do not down load executables"
what is NOT helping is Microsoft's insistence on hiding file extensions preventing easy identification of filetypes.
In a separate rant what Microsoft is also not only not helping with but actively hindering is users understanding filepaths. They hide them obfuscate them , add "libraries" , ID the whole path as "my documents" , add super-hidden Junctions for backward compatibility ...
How are users meant to learn to know where their shit is?
File paths and filetypes are the TWO MOST absolutely fundamental concepts if you ask me and you shouldnt be allowed near a computer till you "get it" .
Microsoft apparently thinks otherwise.
"File paths and filetypes are the TWO MOST absolutely fundamental concepts"
I think the idea is to make computing possible even for people who can't learn fundamental concepts. For an extreme example, I have a learning-disabled niece who gets on quite well with an iPad. On the more mundane end of the spectrum, all of us humans are challenged in one way or another. For a large chunk of people who theoretically _could_ learn fundamental concepts, asking them to do so is only going to make them tired and irritated.
I should add, I don't agree with this idea of hiding file paths, but I don't have a better one.
" asking them to do so is only going to make them tired and irritated."
Its nothing more complicate than learning which cupboard and shelf your freshly laundered towels are to be stored on .
You need to know that if you're ever going to be able to locate your towel .
#HHGTTG
.
.
I'm not asking they know the path to where chrome stores its appdata , just to where they put "mygasbill.xls"
That should immediately ring an alarm!
The thing that Windows, famously, does best is run viruses etc.
If I ever got a message containing such a comment, I would open it on a Raspberry Pi or some other unimportant device that would not run anything like them (I hope).
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
