Thousands of customers of the leading online travel agent Booking.com are being targeted in a sophisticated fraud.