Booking.com Phishing Campaign Hijacks Hotel Accounts to Deliver PureRAT via ClickFix Lure

Threat analysts at Sekoia[.]io have uncovered a global phishing operation targeting the hospitality sector through compromised Booking[.]com and Expedia accounts, in a campaign that blends social engineering, malware delivery, and financial fraud.

The campaign—tracked by Sekoia’s Threat Detection and Response (TDR) team since April 2025—exploits hotel booking platforms as the initial entry point, with attackers first compromising hotel or travel agency accounts and then using these to contact guests with authentic reservation data to boost credibility.

The emails mimic legitimate Booking[.]com communications, with subject lines such as “New guest message linked to your listing” or “New last-minute booking,” and victims are redirected to a malicious page disguised as Booking[.]com’s extranet, initiating what is called the ClickFix infection chain.

According to Sekoia, the final landing page prompts a fake CAPTCHA and asks the user to copy and execute a PowerShell command, after which a ZIP archive containing a Windows executable and several DLLs is downloaded to establish persistence and deploy PureRAT. PureRAT, also known as PureHVNC or ResolverRAT, is sold as part of a MaaS package developed by PureCoder and provides remote desktop access, data exfiltration, and other capabilities over encrypted channels on ports 56001–56003.

The operation also reflects a large underground market trading compromised Booking[.]com and Expedia accounts, with threat actor “moderator_booking” leading a team reportedly earning over $20 million in this field.