How Brand Intelligence Could Help Disrupt the Booking.com ClickFix Campaign
Summary
Microsoft reported Storm-1865 used fake Booking.com pages and ClickFix lures to deliver credential-stealing malware to hospitality staff. Cyble's sponsored walkthrough maps its brand-intelligence tools to the campaign and clarifies it did not participate in the response
Key points
- Microsoft reported Storm-1865 targeted hotel and hospitality staff across multiple regions from December 2024, with the campaign still running in February 2025.
- Lures about guest reviews, enquiries, promotions, or account verification led to fake CAPTCHA pages that told staff to paste a clipboard-copied command into Windows Run.
- The command used mshta.exe to retrieve commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot, and NetSupport RAT.
- Microsoft said campaign payloads could steal credentials and financial data; Booking.com said its own systems were not breached, while some accommodation partners and customers were affected.
- Cyble presents domain monitoring, phishing-page detection, takedowns, and monitoring for exposed credentials as potential intervention points; it does not claim to have responded to this campaign.
- The article highlights email filtering, endpoint detection, script controls, and phishing-resistant MFA as defenses Microsoft recommended.
Article Details
- Topic
- Storm-1865’s ClickFix phishing campaign impersonating Booking.com to target hospitality staff and deliver credential-stealing malware
MITRE ATT&CK
T1204.004 · Malicious Copy and PasteThe fake CAPTCHA instructed victims to paste a command that the page had copied to their clipboard.T1218.005 · MshtaThe pasted command used mshta.exe to retrieve malware.T1566.002 · Spearphishing LinkThe campaign used phishing emails with links, sometimes embedded in PDFs, that led recipients to fake Booking.com pages.
Threat Actors
Malware
AsyncRATThat command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.DanabotThat command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.Lumma StealerThat command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.NetSupport RATThat command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.VenomRATThat command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.XWormThat command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.