Fake Booking.com lures and BSoD scams spread DCRat in European hospitality sector

Researchers have identified a late-December 2025 campaign, dubbed PHALT#BLYX, targeting European hotels with fake Booking-themed emails that lead victims to bogus BSoD pages and prompt the execution of malicious PowerShell commands. According to Securonix, the multi-stage infection chain begins with a click-fix and fake captcha social engineering tactic and deploys a customised DCRat payload, enabling full remote control of infected systems.

The campaign uses an initial lure of a “Reservation Cancellation” with a high charge (for example €1,004.38) to induce urgency, routing the user through an intermediate redirector before arriving at a malicious domain. Victims are directed to fake websites where an MSBuild-based loader downloads and runs an embedded PowerShell script, with the final stage delivering DCRat via a packed .NET loader named staxs.exe and establishing persistence to survive reboots.

The activity is described as blending high-pressure social engineering with Living off the Land techniques to evade detection and maintain long-term access. The article reporting this, by Pierluigi Paganini, was published on 7 January 2026.