• Phishing in Hospitality: Real-world case study reveals how QR codes and fake e-signatures target hotel employees.
• Inside a Hotel Cyberattack: Learn DFIR tactics used to analyze and respond to phishing attempts against hospitality targets.
• Protect your Hospitality Business: Actionable insights from a 2024 phishing case study – download the full report.

As part of the 2025 Trustwave Risk Radar Report: Hospitality Sector, Trustwave SpiderLabs' Digital Forensics and Incident Response (DFIR) team provided an in-depth analysis of how phishing-based cybersecurity threat actors prey on organizations in the hospitality sector.

Drawing on real-world incidents derived from Trustwave SpiderLabs everyday work, the report consolidates data from multiple investigations into a single case study under the pseudonym "Five Star Hotels". This approach ensures client confidentiality while delivering actionable insights.

The case study details a series of phishing campaigns aimed at Five Star Hotels between November and December 2024. These campaigns involved phishing emails containing QR codes and fake e-sign requests, designed to steal employee credentials.

Despite some accounts being compromised, the victims were lucky, and no financial systems or core networks were accessed. All the malicious activity was confined to the targets’ Microsoft 365 environment.

This break out report covers the rigorous forensic analysis Trustwave conducted using Splunk and other tools, allowing the team to identify the origins of the phishing attempts and provided detailed recommendations for strengthening the organizations' security posture.

By examining this case study, cybersecurity professionals can gain practical knowledge on identifying phishing campaigns, securing user accounts, and leveraging incident response strategies to mitigate potential breaches.

Please download all three Trustwave SpiderLabs hospitality industry reports.

• 2025 Trustwave Risk Radar Report: Hospitality Sector
• Deep Dive: A DFIR Case Study in Hospitality
• Deep Dive: How Threat Actors Turn Vulnerabilities into Big Business