CYSCOE at the Romanian Tourism Fair: how stealer malware led to fraud at a travel agency

Event report, November 2024.

At the Cybersecurity Workshop for Travel Agencies, held during the Romanian Tourism Fair at RomExpo, ProDefence represented the Cyber Security Cluster of Excellence (CYSCOE) with a real case: a travel agency defrauded after stealer malware harvested login credentials, allowing criminals to access internal systems and make unauthorised payments.

Key points

• Stealer malware collects saved passwords and session data from infected computers.
• In the case presented, stolen credentials gave attackers access to the agency’s systems and payment flows.
• Travel agencies are exposed because they handle payments, personal data and many third-party platforms, often without a security strategy.
• Basic cyber hygiene measures can be applied immediately and block most such attacks.

The case: credential theft and fraud

Alexandru Angheluș, CEO of ProDefence and President of CYSCOE, walked participants through the incident. The malware harvested login credentials for several platforms used by the agency. With them, the criminals entered the internal systems and carried out financial transactions without authorisation.

“The scenario revealed how cybercriminals use credential-stealing malware to infiltrate business systems and commit fraud. The case underlines the need for cybersecurity education and incident preparedness in the tourism industry.” (Alexandru Angheluș)

Topics covered

• cyber risks for travel agencies without a dedicated security strategy;
• cyber hygiene practices that businesses can apply immediately;
• real attack scenarios and practical lessons for the industry.

What travel agencies can do now

• Do not save passwords in the browser on computers used for payments; use a password manager.
• Enable two-factor authentication on booking, banking and email platforms.
• Separate the payment computer from the one used for browsing and downloads.
• Verify any change of bank details by phone, using a known number.
• Train staff to recognise phishing and suspicious attachments.

Speakers and partners

• Prof. Gabriel Raicu and Prof. Remus Zăgan, Constanța Maritime University;
• Alexandru Angheluș, CEO of ProDefence, representing CYSCOE;
• Dr. Alexandru Bobe, CiTyINNOHub;
• Fraga Țăriuc, President, and Orsolya Bakó, Women4Cyber Romania.

Special thanks to Mihaela Patentasu, Cristian Barhalescu and the National Association of Travel Agencies (ANAT) for facilitating the workshop.

ProDefence’s role

Through CYSCOE, ProDefence supports cybersecurity awareness and capacity building in exposed sectors. Companies affected by similar incidents can turn to ProDefence for malware and fraud analysis, cybercrime investigation support and cybersecurity training.