SHARE

Phishing Campaign Impersonates Booking.com, Plants Malware

Phishing campaign impersonates Booking.com to deploy credential-stealing malware, forcing organizations to boost cybersecurity defenses and stay alert.

Written By

Sunny Yadav

Mar 14, 2025

eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

A recent phishing campaign has raised alarms among cybersecurity professionals after it impersonated Booking.com to deliver a suite of credential-stealing malware.

First detected in December 2024 and persisting into early 2025, the threat targets hospitality organizations across North America, Oceania, Asia, and Europe. Using an insidious social engineering method called ClickFix, attackers manipulate users into unwittingly executing malicious commands, leading to extensive data theft and financial fraud.

The anatomy of the attack

The campaign employs a multi-layered approach, starting with deceptive emails that appear to originate from Booking.com. Here’s what comes next:

These emails lure victims with urgent requests, from resolving guest review issues to verifying account information.
The phishing messages include links or attachments that direct users to fake Booking.com pages.
Once on these pages, a fake CAPTCHA overlay employs the ClickFix technique — users are tricked into copying and executing a command in the Windows Run window.
This command, executed via mshta.exe, downloads and launches various malware families, such as XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot, and NetSupport RAT.

Each malware variant is designed to capture sensitive credentials and financial information, making them potent tools for cybercriminals.

ClickFix: A tactic to bypass traditional defenses

ClickFix capitalizes on human error by presenting victims with seemingly routine error messages. These prompts compel users to engage in actions that bypass standard automated security checks, allowing malware to slip through defenses.

The ease with which these malicious payloads are delivered underscores the sophistication of the campaign. Microsoft’s threat intelligence team, which labels this campaign Storm-1865, emphasizes that the attackers have refined their techniques over time, evolving from previous phishing schemes targeting hotel guests and online shoppers.

Implications for organizations

This evolving threat highlights the importance of robust cybersecurity awareness and defensive measures for organizations. Here’s what enterprises — particularly those in the hospitality sector can do:

Invest in comprehensive user education programs to help staff recognize phishing attempts.
Implement phishing-resistant authentication methods and multi-factor authentication (MFA) across all access points.
Deploy advanced threat detection tools, such as Microsoft Defender for Endpoint and Office 365, to identify and neutralize suspicious activities before significant damage occurs.

As phishing tactics evolve, staying ahead of adversaries with updated threat intelligence and continuous employee training is crucial to minimizing risk and protecting sensitive data.

To further fortify your security measures, learn about spear phishing, which targets individuals or specific groups in an organization, and how you can avoid it.

Sunny Yadav

Sunny is a content writer for eSecurity Planet (eSP) with a bachelor’s degree in technology and experience writing for leading cybersecurity brands like Panda Security, Upwind, and Vanta. At eSP, he covers the latest news on cyberattacks, cryptography, data protection, and emerging threats and vulnerabilities. He also explores security policies, governance, and endpoint and mobile security. Sunny enjoys hands-on testing, rigorously evaluating tools to assess their capabilities and real-world performance. He also has extensive experience working with AI tools like ChatGPT and Gemini, experimenting with their applications in cybersecurity, content creation, and research.