Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware

Cybersecurity researchers have flagged a large-scale phishing campaign aimed at the hospitality sector that lures hotel managers to ClickFix-style pages and harvest credentials by deploying PureRAT malware. The attackers reportedly use a compromised email account to send spear-phishing messages impersonating Booking[.]com and direct recipients to malicious sites, a tactic described by Sekoia as part of a broader ClickFix social engineering playbook.

The end goal is to obtain credentials for Booking[.]com or Expedia to gain access to booking platforms, with stolen data allegedly sold on cybercrime forums or used to fraudulently contact customers. The activity has been active since at least April 2025 and was observed as of early October 2025, with targets across multiple countries and via WhatsApp or email.

The campaign's PowerShell–driven rig installs a modular PureRAT (aka zgRAT) payload capable of remote access, keylogging, webcam/mic capture, and more, and it can persist on hosts through a Run registry key, while logs and Booking[.]com/extranet data are said to be traded on criminal forums, including a threat actor named moderator_booking offering a Booking log service, according to Sekoia.