Loading story…
A sophisticated cybercrime operation has targeted the hospitality sector by compromising hotel systems through phishing emails that impersonate Booking.com communications. Attackers use the ClickFix social engineering technique to trick hotel staff into clicking malicious links or copying and pasting PowerShell commands, which results in the installation of PureRAT malware. Once installed, PureRAT provides attackers with full remote access to hotel systems, enabling them to steal professional login credentials for booking platforms and access sensitive guest reservation data. The campaign, active since April 2025, leverages both direct email phishing and drive-by downloads to infect hotel staff, with compromised hotel account access often sold on underground forums.
With access to genuine hotel Booking.com accounts, the attackers launch highly convincing phishing attacks against travelers, using stolen reservation and contact details to increase the credibility of their messages. Victims are contacted via WhatsApp or email and directed to spoofed Booking.com pages designed to harvest banking information. The PureRAT malware, delivered via a previously unobserved loader variant using DLL sideloading and persistence mechanisms like the Run registry key, enables a wide range of malicious activities, including keylogging, webcam and microphone capture, and data exfiltration. Security researchers have highlighted the organized nature of the operation and the use of malware-as-a-service infrastructure, underscoring the ongoing threat to both hotels and their guests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By November 2025, Sekoia publicly reported on the campaign, describing the ClickFix infection chain, the loader used to deliver PureRAT, and phishing infrastructure including at least one site hosted on a Russia-based IP in the OPTIMA LLC autonomous system. The report also highlighted criminal-market support for Booking.com-related phishing and stolen credentials.
Researchers observed the initial hotel-focused phase of the campaign running from April 2025 through early October 2025. During this period, attackers continued compromising hospitality organizations and harvesting credentials for booking platforms.
Using access to hotel systems and booking-platform accounts, attackers launched secondary phishing against travelers through email and sometimes WhatsApp. The messages used stolen real reservation details and spoofed Booking.com or Expedia payment pages to steal banking information and support fraud.
After hotel staff executed the malicious commands, attackers installed a previously unobserved loader variant similar to QuirkyLoader, using DLL sideloading, a Run registry key for persistence, and in-memory loading via AddInProcess32.exe to deploy PureRAT. This established access to hotel systems and accounts for follow-on abuse.
A phishing campaign targeting the hospitality sector was active by at least April 2025, using emails impersonating Booking.com or messages sent from compromised legitimate accounts to lure hotel managers and staff. Victims were directed to ClickFix-style pages with fake CAPTCHAs that tricked them into running PowerShell commands.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcedarkreading.com
Open sourcethehackernews.com
Open sourcehackread.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are impersonating **Booking.com** pages in an ongoing **ClickFix** phishing campaign targeting the hospitality sector, tricking users into opening the Windows Run dialog and pasting attacker-supplied PowerShell that installs remote-access malware. Recent waves used Booking.com-branded lures such as `secure-extranet[.]com`, redirectors including `jskeowgo[.]com`, and additional phishing subdomains aimed at hotel staff, with some activity specifically targeting Italian-speaking users. Researchers observed multiple payload paths: one chain deployed **NetSupport RAT** through a large PowerShell stage that unpacked 14 base64-encoded components and then opened the legitimate Booking.com site to preserve the pretext, while another used staged loaders, ZIP delivery, and DLL sideloading via a legitimate `psl.exe` binary to install **zgRAT** and **PureHVNC**. The malware provided full remote-control capability, including shell access, file transfer, keylogging, screen capture, and webcam or audio access, and established persistence through mechanisms such as Startup-folder shortcuts and `HKCU\Run` keys like `SystemUpdate_<VID>`. Infrastructure linked to the activity included freshly registered domains obtained in batches through Chinese and Hong Kong registrars, rotating download servers, telemetry endpoints that tracked installation progress per victim, and command-and-control systems hosted across providers in Frankfurt, Russia-linked environments, and a likely bulletproof-hosting setup tied to a newly created autonomous system. Investigators also found OPSEC clues including an exposed RDP certificate leaking the hostname `WIN-FLJTJKL01VM`, a PDB path referencing `C:\Users\Administrator\Desktop\HTCTL32\`, and malware signed with a stolen `*.dodo.com` wildcard certificate, supporting clustering of the campaign as a financially motivated cybercrime operation using commodity RAT tooling.
Jun 29, 2026
Suspected Russian cybercriminals have launched a sophisticated phishing campaign targeting the European hospitality industry, leveraging fake Windows Blue Screen of Death (BSOD) pages to distribute malware. The attack, tracked as "PHALT#BLYX" by Securonix researchers, begins with phishing emails impersonating popular booking platforms such as Booking.com, often using reservation cancellation lures with details in Euros to specifically target hotels, hostels, and inns in Europe. Victims are directed to high-fidelity cloned websites that mimic legitimate booking services, where they encounter fake error messages and BSOD screens designed to prompt them into executing malicious commands. The campaign employs the "ClickFix" technique, which manipulates users into manually running PowerShell or shell commands under the guise of resolving system errors. This process ultimately results in the installation of the DCRat malware, a remote access trojan capable of keylogging and other malicious activities. Technical indicators, including Russian-language debug strings and infrastructure geolocated to Russia, suggest a strong Russian connection. The campaign demonstrates a blend of social engineering and technical deception, exploiting human problem-solving instincts to compromise systems within the hospitality sector during its busiest season.
Jun 29, 2026
TA558, a financially motivated threat actor active since 2018, has persistently targeted hospitality, hotel, and travel organizations—primarily in Latin America—using Portuguese- and Spanish-language reservation and booking lures. Researchers linked the actor to repeated campaign markers such as the string **"CDT"**, fake travel and hotel branding, and attacker-controlled or compromised hospitality infrastructure. Proofpoint reported that TA558 expanded activity and shifted delivery techniques from macro-enabled Office files to URLs and container attachments such as `RAR` and `ISO`, while continuing to distribute a broad set of remote access trojans including **Loda RAT**, **Revenge RAT**, **AsyncRAT**, **njRAT**, **Ozone RAT**, and **Vjw0rm**. Multiple investigations show the campaigns using multi-stage infection chains to gain remote access and steal data. Cisco Talos documented **Loda RAT** delivery through phishing documents exploiting `CVE-2017-11882`, with capabilities including keylogging, screenshots, audio capture, FileZilla credential theft, and WMI-based antivirus enumeration. Uptycs tied a Brazilian hotel-themed lure, **"Rooming List Reservas para 3 Familias.docx,"** to **Revenge RAT** delivered via remote template injection and staged PowerShell and VBScript, while Elastic observed a related booking-themed chain using a fake **"Card & Booking Details.docx"** document to deploy **XWORM** and **Agent Tesla**, disable defenses, create persistence, and exfiltrate data through a Discord webhook. The activity indicates sustained credential theft, reconnaissance, follow-on malware delivery, and potential financial fraud against both travel-sector organizations and their customers.
Aug 15, 2026