Airbnb Callback Phishing Uses Real Airbnb Notifications and a Per-Victim Forwarding Chain

At a glance

• Sender: Airbnb’s real transactional notifications

• Authentication: SPF, DKIM, DMARC and BIMI all passed

• Payload: no link or attachment; a callback lure inside Airbnb’s own template

• Tailoring: one attacker-created listing and one forwarding chain per victim organization

What happened

Starting in late April 2026, Ocean saw callback phishing emails signed by Airbnb’s sending domain. The body read “Payment Successful, To Cancel Call Us” followed by a phone number. The text was the name of a free Airbnb host listing the attacker created, so Airbnb’s own notification rendered the lure.

How the relay chain worked

1. Airbnb sends a listing notification to an attacker-controlled iCloud address

2. iCloud forwards it to a GMX account, and Apple’s forwarding headers reveal the next hop

3. GMX forwards it to the corporate inbox with the body intact, so Airbnb’s DKIM body hash stays valid

4. The victim’s gateway evaluates SPF, DKIM and DMARC and all three pass

The deletion wave

The attacker deleted listings in sequence. Each deletion triggered an Airbnb notification that carried that listing’s name, and the lure, to a different enterprise victim. In the captured window, deletions landed nine minutes apart. The attacker built nothing and compromised no accounts.

Why it got past email security

How Ocean caught it

Ocean tied the emails together through the same callback number appearing across different listings and through forwarding header details such as X-Apple-Action, which exposed the iCloud-to-GMX relay behind each message.

What security teams should do

1. Treat a phone number in a transactional notification as a lure signal, even when the sender is authenticated

2. Don’t allow-list consumer platform notifications by domain alone

3. Train service desks and finance teams to verify cancellation and refund calls through known channels

Indicators