Microsoft Threat Intelligence

Starting in December 2024, Microsoft Threat Intelligence identified a phishing campaign that impersonates online travel agency Booking .com and delivers multiple credential-stealing malware used for financial fraud and theft. https://msft.it/6012quK58

Tracked as Storm-1865, the campaign targets individuals in hospitality organizations that are most likely to work with Booking .com sending fake emails purporting to be from the agency.

It uses a social engineering technique called ClickFix, which takes advantage of human problem-solving tendencies by tricking target users into copying, pasting, and launching commands to fix supposed issues.

In this campaign’s case, the user is prompted by a fake CAPTCHA message to use a keyboard shortcut to launch a command that eventually downloads the malware payload. Check our blog to read our analysis and to get protection recommendations and hunting guidance.