Loading threat actor…
PHALT#BLYX is a malware campaign and associated threat activity targeting the European hospitality sector, particularly hotel organizations, through phishing and ClickFix-style social engineering. The operation uses Booking.com-themed reservation-cancellation lures to drive victims to fraudulent pages that present fake verification or system-failure prompts, including a counterfeit Windows blue screen, to coerce users into manually executing malicious PowerShell commands. This user-driven execution helps the intrusion bypass many automated security controls. The infection chain abuses trusted Windows tooling, notably MSBuild, to compile or execute a heavily obfuscated payload and ultimately deploy Dark Crystal RAT (DCRat). Reported post-compromise capabilities include persistent remote access, system reconnaissance, keylogging, screenshot capture, clipboard monitoring, remote command execution, secondary payload delivery, and process hollowing or injection into legitimate processes to conceal activity. The campaign has also demonstrated defense-evasion behavior through abuse of legitimate binaries and tampering with Windows Defender exclusions. PHALT#BLYX has been assessed as Russia-linked based on Russian-language artifacts observed in the attack chain and the use of DCRat, a malware family with Russian origins and longstanding circulation in Russian-language criminal ecosystems. The activity appears financially motivated and operationally focused on gaining and maintaining access to victim environments rather than conducting ransomware or destructive attacks. The campaign has evolved over time from simpler delivery and execution methods to more stealthy MSBuild-based tradecraft, indicating iterative refinement to improve evasion and persistence.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PHALT#BLYX is a malware campaign targeting the European hospitality sector using phishing emails, fake system crash screens, and abuse of Windows build tools to deploy remote access trojans.
PHALT#BLYX is a Russia-linked threat actor group conducting a malware campaign targeting European hospitality organizations. They use phishing emails mimicking Booking.com to trick hotel staff into executing malicious PowerShell commands, resulting in remote access trojan installation and ongoing system compromise.
PHALT#BLYX is conducting a malware campaign targeting European hospitality organizations using phishing emails that mimic Booking.com, leading to social engineering attacks that trick staff into executing malicious PowerShell commands, resulting in remote access trojan installation.
A ClickFix-style social engineering campaign targeting the hospitality sector (Booking.com-themed reservation cancellation lures) that coerces victims into running malicious PowerShell, abuses MSBuild.exe to compile/execute payloads, and ultimately deploys an obfuscated DCRat RAT with capabilities including process hollowing, keylogging, persistence, and secondary payload delivery.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.