TONResolver Booking.com Impersonation Phishing with ICS Attachment

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects phishing emails associated with the TONResolver campaign that impersonate Booking.com guest complaints. The rule identifies suspicious emails containing .ics calendar file attachments or links to domains matching the pattern 'photo-[0-9]+.cfd', primarily targeting hospitality staff with subject lines related to hotel inquiries or issues.