TONResolver RAT Booking.com Phishing Targeting Japanese Hotel Staff

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors email metadata for patterns associated with known phishing campaigns mimicking Booking.com. It looks for specific lures in email subjects, suspicious attachment filenames such as 'invite.ics', malicious domains using the .cfd TLD, or body text containing 'Download Photos and Videos'.