ESET researchers have discovered that Telekopye, a Telegram-based toolkit used by cybercriminals to scam people on online marketplaces, has expanded its operations to target users of popular accommodation booking platforms like Booking.com and Airbnb. The scammers, referred to as Neanderthals, now utilize compromised accounts of legitimate hotels to contact potential victims with fake payment issues. This new scam scenario provides personalized, legitimate-looking information, making it harder to detect. The scammers have also implemented advanced features such as automated phishing page generation, interactive chatbots with translation capabilities, and anti-DDoS measures. Recent law enforcement operations have shed light on the groups' recruitment practices, revealing a dark side to their operations.