Microsoft is warning that an ongoing phishing campaign impersonating Booking.com is using ClickFix social engineering attacks to infect hospitality workers with various malware, including infostealers and RATs. In the phishing campaign discovered by Microsoft, the threat actors send emails impersonating pretending to be guests inquiring about a negative Booking.com review, requests from prospective clients, account verification alerts, and others. The threat actors' goal is to hijack employee accounts on the Booking.com platform and then steal customer payment details and personal information, potentially using it to launch further attacks on guests. When solving the malicious CAPTCHA, a hidden mshta.exe command will be copied to the Windows clipboard to perform the "human verification" process. Executing the command downloads and installs a wide variety of remote access trojans and infostealing malware, including XWorm, Lumma stealer, VenomRAT, AsyncRAT, Danabot, and NetSupport RAT. ClickFix is a relatively new social engineering attack that displays fake errors on websites or in phishing documents and then prompts users to perform a "fix" "captcha" to view the content. However, these fake fixes are actually malicious PowerShell or other malicious commands that download and install infostealing malware and remote access trojans on Windows and Mac devices. In this campaign, Microsoft says that the copied code is a mshta.exe that executes a malicious HTML file [VirusTotal] on the attacker's server. A fake CAPTCHA in ClickFix campaigns has become popular as it adds a false sense of legitimacy to the process, hoping to trick recipients into lowering their guard. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. To defend against these attacks, Microsoft recommends always confirming the legitimacy of the sender's address, being extra careful when met with urgent calls to action, and looking for typos that could give away scammers. The campaign started in December 2024 and continues today, targeting employees at hospitality organizations such as hotels, travel agencies, and other businesses that use Booking.com for reservations. This type of attack has become increasingly popular and is used by a wide variety of threat actors, including ransomware gangs and North Korean hackers.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 13 Mar 2025 15:05:16 +0000