Malware: Hotel and accommodation, Switzerland 2025
Attackers posed to hotels as guests with an unresolved problem and sent a link to a supposed booking.com portal.
- Incident · 03.2025 · Switzerland
- Evidence: confirmed by an authority
- Malware
- Phishing
- Deception (social engineering)
As of
What happened
A fake captcha asked them to press the Windows key and R, then Ctrl and V, which executed malware; using captured reservation data, the perpetrators then wrote to guests. One guest was asked to transfer more than 2000 francs to a foreign IBAN and upload the receipt.
- Affected
- Company (anonymous)
- Industry
- Hotel and accommodation
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Email from a supposed guest with a link to a fake booking portal and a fake captcha
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
No legitimate captcha asks for key combinations; if you see something like this, close the page.
Sources
- Wochenrückblick Woche 9: Hotels und ihre Gäste sind immer wieder im Visier von Cyberkriminellen (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 04.03.2025
«Um die Buchung zu bestätigen, sollte das Opfer über CHF 2000 auf eine IBAN überweisen und anschliessend den Zahlungsbeleg auf das Portal hochladen.»