Security researchers at Securonix have uncovered a sophisticated ClickFix malware campaign targeting the hospitality sector, tracked as PHALT#BLYX.
The attack utilizes fake reservation-cancellation messages, impersonating Booking.com, to lure victims into executing malicious PowerShell commands, ultimately deploying DCRat (Dark Crystal RAT) — a Russia-linked remote access Trojan.
How the attack works
The infection chain is highly deceptive and multi-stage:
- Victims are sent phishing emails with fake Booking.com cancellation notices
- A spoofed booking page presents a fake CAPTCHA challenge
- After interaction, victims are shown a fake Windows Blue Screen of Death
- Users are tricked into running a PowerShell command under the guise of fixing the issue
- Malware is compiled and executed using MSBuild.exe, a trusted Windows binary
The final payload is a heavily obfuscated version of DCRat, capable of:
- Process hollowing
- Keylogging
- Persistent remote access
- Dropping secondary payloads
Targeting & attribution clues
- Fake booking charges displayed in EUR, suggesting European targets
- Use of Russian language artifacts
- Malware lineage linked to Dark Crystal RAT, previously used in attacks against Ukraine
Researchers say the campaign demonstrates a deep understanding of endpoint security, including:
- Abuse of trusted system binaries
- Injection into legitimate processes like aspnet_compiler.exe
- Tampering with Windows Defender exclusions
- Long-term persistence techniques
Why ClickFix remains dangerous
ClickFix attacks, first detailed in 2024, rely on social engineering, not exploits. Users are convinced to run malicious commands themselves, bypassing many traditional defenses.
This campaign also leveraged the holiday travel season, when hospitality-related emails are expected, increasing the success rate.
Defensive guidance
Securonix recommends organizations:
✔ Educate users never to paste scripts into Run or PowerShell when prompted by browser pages
✔ Treat urgent booking or payment emails with caution
✔ Enable file extension visibility in Windows
✔ Monitor MSBuild.exe execution from non-standard paths
✔ Watch legitimate binaries (aspnet_compiler.exe, RegSvcs.exe, RegAsm.exe) for abnormal network activity
Key takeaway
This campaign demonstrates how attackers combine psychological pressure, trusted Windows tools, and clever deception to bypass defenses, turning users into the execution vector.
User awareness remains one of the strongest defenses against ClickFix attacks.
