The ClickFix Trap: PHALT#BLYX Targets Hotels with Fake Blue Screens and DCRat

A new cyber-espionage campaign dubbed PHALT#BLYX is targeting the hospitality sector, with researchers noting a blend of social engineering and living-off-the-land techniques to deploy remote access trojans. The operation uses a “click-fix” tactic that persuades frustrated hotel staff to paste a PowerShell script into their terminal after encountering a fake Blue Screen of Death on a spoofed Booking[.]com landing page.

According to Securonix researchers, the infection chain relies on trusted Windows tools like MSBuild.exe to bypass security scanners, eventually injecting malware into legitimate processes such as aspnet_compiler.exe to mask activity. The payload at the heart of the campaign is DCRat (DarkCrystal RAT), with later stages observed deploying AsyncRAT as well.

The campaign is linked to Russian-speaking threat actors, based on native language artifacts in deployment scripts, and is described as a sophisticated attempt to maintain long-term persistence and evade detection. Securonix advises organisations to look beyond file-based detection and focus on behavioural anomalies and process lineage to identify and stop these multi-staged attacks. 7 January 2026.