A newly uncovered phishing campaign is targeting employees in the hospitality sector by impersonating Booking.com, one of the world’s largest online travel agencies. At the heart of the campaign is a clever trick called ClickFix—a social engineering tactic that convinces users to execute malware on their own systems.

First detected in December 2024, the campaign has been traced to a threat actor Microsoft tracks as Storm-1865, and its impact has stretched across North America, Europe, Oceania, and Southeast Asia. The goal? Steal login credentials, plant malware, and commit financial fraud.

A Simple Email, a Fake Review, and a Deceptive Link

Booking.com as the Bait

The attack begins with an email that appears to come from Booking.com, claiming a customer has posted a negative review. The target is asked to respond or provide feedback.

Included in the message is either a link or a PDF file with a clickable link, which appears to take the recipient to the real Booking.com website. But clicking it leads elsewhere—a fake CAPTCHA page, carefully designed to mimic Booking.com’s branding in the background.

This tactic helps lower the victim’s guard, encouraging them to follow on-screen instructions.

ClickFix: The Technique Fooling Even Cautious Users

Turning Victims into Unknowing Attackers

The ClickFix method is at the core of this phishing attack. Once users reach the fake CAPTCHA screen, they’re prompted to press Windows + R, paste a command from the site, and press Enter.

That command quietly uses a built-in Windows utility—mshta.exe—to pull in the malware payload.

This user-driven technique works so well because it bypasses traditional security filters, which often rely on detecting malicious links or file attachments. In this case, the user unwittingly runs the code themselves, making the attack difficult to stop.

What Happens Next?

The malware installed varies but includes well-known threats like:

  • XWorm – A remote access trojan (RAT)
  • Lumma Stealer – Steals browser data, credentials, and more
  • VenomRAT, AsyncRAT, Danabot, NetSupport RAT – Other tools for stealing data and gaining remote control

All of them give the attacker ongoing access to the victim’s machine and sensitive information.

Storm-1865: A Growing and Evolving Threat Actor

From E-commerce to Hospitality

Microsoft previously observed Storm-1865 targeting online shoppers with fake payment pages linked to platforms like Gmail and iCloud. Their tactics continue to evolve as they now use vendor-specific lures, such as Booking.com-themed emails, to reach industry-specific employees.

This campaign is part of a larger trend in which threat actors are refining their phishing lures to match the roles and behaviors of their targets.

Not Just Criminals: APTs Are Now Using ClickFix Too

Nation-State Actors Adopt the Same Technique

Cybersecurity experts have reported that even advanced persistent threat (APT) groups linked to countries like Russia and Iran are now using ClickFix in their campaigns.

One example is APT28 (associated with Russia), and another is MuddyWater (believed to be linked to Iran). Both have integrated ClickFix in recent social engineering attacks.

According to Group-IB, the success of this method lies in its ability to trick users into completing the infection process themselves—a clever way to dodge detection.

Variations on the ClickFix Theme

ClickFix Is Versatile—and It’s Spreading Fast

Security firms have observed several variations of ClickFix-based attacks, including:

  • Fake CAPTCHA challenges that launch PowerShell scripts delivering Lumma and Vidar Stealers
  • Google reCAPTCHA-themed lures deployed by the Blind Eagle group
  • Booking confirmation links that redirect to malware download pages
  • Windows-themed decoy pages that prompt similar command execution steps

Each variant uses a false problem and a misleading solution to push the user into action. And once they comply, the malware silently moves in.

GitHub Repositories as Malware Launchpads

AI-Generated Pages, Real-World Damage

In one ClickFix campaign analyzed by Trend Micro, attackers uploaded fake GitHub repositories using AI-generated descriptions and fake reviews. These pages offered:

  • Game cheats
  • Cracked tools
  • Cryptocurrency utilities

Victims downloaded ZIP files thinking they were getting something helpful, but instead received a loader program—named SmartLoader—which deployed Lumma Stealer.

The abuse of trusted platforms like GitHub makes detection and prevention much harder, especially for individuals and small businesses.

G DATA Reports Regional Focus

Victims in Germany and the Philippines

According to German security firm G DATA, one variation of this campaign has heavily targeted users in Germany and the Philippines.

The company observed fake Booking.com messages embedded with ClickFix steps that led directly to the Lumma Stealer—a repeated choice among attackers due to its wide functionality and high success rate.

Other Recent Stealer Campaigns and Evolution

Beyond Lumma: The Rise of StrelaStealer and Custom Loaders

Alongside Lumma and XWorm, other stealers are appearing more often. Trustwave recently shared findings about StrelaStealer, delivered through fake invoice emails.

This malware uses layered obfuscation and custom crypters like Stellar Loader to hide from antivirus tools. It reflects a larger move toward highly customized delivery tools built to match specific payloads.

Why ClickFix Works So Well

It Uses Trust, Not Tech, to Bypass Security

ClickFix doesn’t rely on hidden exploits or zero-day flaws. Instead, it exploits human behavior:

  • Users believe they’re solving a problem
  • They follow the instructions willingly
  • The malware avoids detection because the user starts the process

It’s a new twist on social engineering that combines familiar-looking websites, minor tech jargon, and urgency to move quickly from click to infection.

How to Protect Against ClickFix Campaigns

Tips for Individuals and Organizations

  1. Never follow manual commands from unknown websites
  2. Watch for urgency or emotional manipulation in emails
  3. Train teams on emerging phishing methods, including ClickFix
  4. Block access to mshta.exe if not used internally
  5. Use email filtering to catch fake travel or invoice messages
  6. Apply behavioral monitoring tools to detect abnormal command use

FAQs

What is the ClickFix technique in phishing?
ClickFix is a social engineering method where a fake webpage tells the user to run a command on their computer, usually resulting in malware installation.

How is Booking.com used in the phishing scam?
Attackers pretend to send negative reviews from Booking.com to hospitality workers. The email includes links or PDFs that direct users to fake sites prompting malware installation.

What types of malware are dropped in these attacks?
Common payloads include Lumma Stealer, XWorm, NetSupport RAT, VenomRAT, and Danabot.

Why does ClickFix evade security tools?
Because the victim willingly runs the command, traditional antivirus tools may not see it as suspicious.

Who is Storm-1865?
A threat actor tracked by Microsoft responsible for phishing and financial fraud across various industries, now using ClickFix tactics.

Are APT groups using ClickFix?
Yes. Nation-state actors from countries like Russia and Iran have adopted ClickFix to deliver malware like KoSpy and SMOKESABER.

Author

Share.

256 Comments

  1. I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.

  2. I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.

  3. Yo, 84win219! Just signed up, and the site is smooth. Deposits were quick, and the game selection is solid. Hoping for some big wins, but even if not, seems like a legit place to have some fun. Check them out here: 84win219

  4. jiliasia7 app|jiliasia7 slots|jiliasia7 download|jiliasia7 login|jiliasia7 casino Experience the ultimate online gaming at Jiliasia7 Casino, the top choice for players in the Philippines. Play the best jiliasia7 slots, access your secure jiliasia7 login, and get the jiliasia7 app via the official jiliasia7 download to start winning today! visit: jiliasia7

  5. Gave sao29win a whirl last night and had a decent run. A few wins, a few losses, you know how it goes. Seems legit enough. I’ll probably be back. Head there for fun! sao29win

  6. Just signed up for vipjili and the welcome bonus was pretty sweet. Lots of options to choose from. Gonna see if I can turn this bonus into something big! Best of luck to you too! vipjili

  7. I stumbled across 7e77bd the other day. Clean interface and easy to use. Nothing groundbreaking, but it does the job. Worth a look-see if you’re looking for something new. Go there now! 7e77bd

  8. I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.

  9. Downloaded the qqggapp, and it’s pretty straightforward. Easy to get around and find what you’re looking for. Solid if you’re into mobile gaming. Give it a whirl: qqggapp

  10. Gave vntb88 a try and it was pretty good! Lots of different games to choose from, and the site was easy to use. I’d recommend giving it a shot: vntb88

  11. I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.

  12. Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  13. Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  14. Hey there, I think your blog might be having browser compatibility issues. When I look at your blog site in Chrome, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other then that, very good blog!

  15. Aw, this was a really good post. Taking the time and actual effort to generate a great article… but what can I say… I put things off a lot and don’t manage to get nearly anything done.

  16. Aw, this was a very good post. Spending some time and actual effort to generate a top notch article… but what can I say… I put things off a lot and never seem to get anything done.

  17. Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

  18. May I simply say what a relief to discover a person that actually knows what they’re talking about on the net. You actually know how to bring an issue to light and make it important. More people must look at this and understand this side of the story. It’s surprising you aren’t more popular because you most certainly possess the gift.

  19. Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

  20. At this time it seems like Expression Engine is the preferred blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?

  21. Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

  22. I’m no longer positive where you’re getting your information, however great topic. I must spend some time studying much more or understanding more. Thanks for excellent information I used to be searching for this info for my mission.

  23. Right now it sounds like WordPress is the preferred blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?

  24. May I simply say what a comfort to find somebody that truly knows what they are discussing online. You certainly realize how to bring an issue to light and make it important. More people really need to check this out and understand this side of your story. I can’t believe you’re not more popular since you surely have the gift.

  25. Do you mind if I quote a couple of your articles as long as I provide credit and sources back to your webpage? My website is in the very same area of interest as yours and my users would definitely benefit from some of the information you provide here. Please let me know if this alright with you. Many thanks!

  26. Hey there, You have performed an incredible job. I’ll certainly digg it and in my opinion suggest to my friends. I am confident they will be benefited from this site.

  27. At this time it sounds like Movable Type is the best blogging platform available right now. (from what I’ve read) Is that what you’re using on your blog?

  28. Wow that was strange. I just wrote an really long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Anyways, just wanted to say superb blog!

  29. May I simply say what a comfort to uncover a person that genuinely knows what they are discussing online. You definitely realize how to bring a problem to light and make it important. More people need to read this and understand this side of the story. It’s surprising you aren’t more popular because you most certainly have the gift.

  30. Hi there, You have performed an excellent job. I’ll definitely digg it and in my view recommend to my friends. I’m confident they’ll be benefited from this site.

  31. Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

  32. Aw, this was an extremely good post. Taking the time and actual effort to create a superb article… but what can I say… I put things off a whole lot and don’t manage to get anything done.

  33. At this time it appears like Expression Engine is the preferred blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?

  34. May I simply just say what a relief to discover somebody who really understands what they are discussing on the web. You actually realize how to bring an issue to light and make it important. More and more people should look at this and understand this side of the story. I was surprised you’re not more popular because you certainly have the gift.

  35. May I simply say what a comfort to discover somebody who really knows what they’re talking about online. You certainly know how to bring a problem to light and make it important. More and more people ought to check this out and understand this side of your story. I was surprised you’re not more popular because you definitely have the gift.

  36. Wow that was unusual. I just wrote an very long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Anyways, just wanted to say great blog!

  37. Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

  38. Wow that was strange. I just wrote an very long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Anyhow, just wanted to say great blog!

  39. Right now it looks like BlogEngine is the best blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?

  40. Can I simply just say what a relief to uncover a person that truly knows what they are discussing on the web. You certainly know how to bring a problem to light and make it important. More and more people need to check this out and understand this side of your story. I can’t believe you’re not more popular given that you surely have the gift.

  41. Hey there, You have performed a great job. I will definitely digg it and individually suggest to my friends. I’m confident they will be benefited from this website.

  42. Can I simply just say what a comfort to discover an individual who really knows what they are discussing online. You certainly understand how to bring a problem to light and make it important. More and more people ought to check this out and understand this side of your story. I was surprised that you are not more popular since you most certainly have the gift.

  43. Aw, this was a really nice post. Taking the time and actual effort to create a top notch article… but what can I say… I put things off a whole lot and don’t manage to get anything done.

  44. At this time it appears like Drupal is the best blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?

  45. At this time it seems like Movable Type is the preferred blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?

  46. May I simply just say what a comfort to uncover someone that genuinely understands what they’re talking about on the web. You definitely know how to bring a problem to light and make it important. More people ought to read this and understand this side of your story. I can’t believe you are not more popular given that you surely possess the gift.

  47. At this time it looks like BlogEngine is the top blogging platform available right now. (from what I’ve read) Is that what you’re using on your blog?

  48. Hello there, You have done an incredible job. I’ll certainly digg it and in my view suggest to my friends. I’m sure they’ll be benefited from this website.

  49. Wow that was strange. I just wrote an extremely long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Anyways, just wanted to say great blog!

  50. Currently it looks like BlogEngine is the preferred blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?

  51. Wow that was unusual. I just wrote an extremely long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Regardless, just wanted to say fantastic blog!

  52. Hey there, You’ve done a great job. I’ll certainly digg it and individually suggest to my friends. I’m confident they’ll be benefited from this website.

  53. May I simply say what a relief to discover someone that really understands what they are discussing over the internet. You definitely understand how to bring a problem to light and make it important. More and more people must read this and understand this side of the story. I was surprised you’re not more popular given that you definitely possess the gift.

  54. Hello there, You have done an excellent job. I’ll definitely digg it and individually recommend to my friends. I’m sure they’ll be benefited from this website.

  55. Wow that was unusual. I just wrote an extremely long comment but after I clicked submit my comment didn’t appear. Grrrr… well I’m not writing all that over again. Anyhow, just wanted to say wonderful blog!

  56. Wow that was odd. I just wrote an very long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Anyways, just wanted to say great blog!

  57. Aw, this was an incredibly nice post. Taking the time and actual effort to make a top notch article… but what can I say… I hesitate a whole lot and don’t manage to get nearly anything done.

  58. Right now it sounds like BlogEngine is the preferred blogging platform available right now. (from what I’ve read) Is that what you are using on your blog?

  59. Please let me know if you’re looking for a writer for your site. You have some really great posts and I think I would be a good asset. If you ever want to take some of the load off, I’d love to write some content for your blog in exchange for a link back to mine. Please send me an email if interested. Kudos!

  60. Hey there, You’ve performed an excellent job. I’ll definitely digg it and individually recommend to my friends. I’m confident they will be benefited from this web site.

  61. Wow that was strange. I just wrote an really long comment but after I clicked submit my comment didn’t appear. Grrrr… well I’m not writing all that over again. Anyhow, just wanted to say wonderful blog!

  62. Can I simply just say what a relief to discover a person that genuinely knows what they’re talking about over the internet. You definitely realize how to bring an issue to light and make it important. A lot more people have to check this out and understand this side of the story. It’s surprising you’re not more popular given that you certainly have the gift.

Leave A Reply

© 2026 ThemeSphere. Designed by ThemeSphere.
Exit mobile version