Major phishing attack hits hotels with clever new scam that also spreads dangerous malware

• ClickFix Phishing Campaign Targets Hotels and Guests with PureRAT Malware
• Attackers exploit compromised Booking.com accounts, sell stolen credentials on dark web forums
• Guests were tricked into accessing fake Booking/Expedia sites, losing their login and payment card details.

Experts have warned that hotels and their guests are being targeted by a highly sophisticated ClickFix campaign that aims to deliver dangerous malware, steal login credentials and conduct fraudulent electronic transactions.

Cybersecurity researchers Sekoia revealed that the attackers would first use random, compromised email accounts to send phishing messages to hotels and different Booking.com account holders. The link in the message triggers a redirect chain that ultimately leads to a fake reCAPTCHA challenge, designed to get victims to download and install a remote access Trojan called PureRAT.