Sophisticated ClickFix Campaign Targeting Hospitality Sector

Securonix warns of a stealthy ClickFix campaign targeting the hospitality sector for remote access trojan deployment, beginning with phishing emails that claim Booking[.]com reservation cancellations and link to an impersonating site displaying a fake CAPTCHA. Once the link is clicked, a deceptive browser error leads to a fake BSOD animation, with the phishing messages dubbed PHALT#BLYX and including room charge details in euros to encourage clicks.

The attack chain then prompts the user to click a reload button, triggering PowerShell commands that download a malicious MSBuild project file, which is compiled and executed to disable Windows Defender, establish persistence, and run a customized version of the DCRat RAT, described as a high‑resilience variant of AscynRAT.

The payload checks user privileges and may attempt to run with elevated rights via UAC spam, according to the report, which notes that the threat actors behind it are likely of Russian origin and targeting organisations in Europe. Written by Ionut Arghire and published on 6 January 2026. according to Securonix.