ClickFix Campaign Serves Up Fake Blue Screen of Death

A new ClickFix campaign, tracked as PHALT#BLYX, has been identified by researchers from Securonix as targeting hospitality-sector clients with a multistage infection chain that blends fake captcha challenges with a legitimate Microsoft tool. The campaign ultimately deploys DCRat, a Russia-linked remote access Trojan, and uses fake Booking[.]com lures to coax victims into running malicious PowerShell commands.

It also exploits MSBuild.exe to compile and execute its payload, described as a heavily obfuscated version of DCRat capable of process hollowing, keylogging and persistent remote access. The fake booking page features European euro currency charges and Russian language elements, suggesting Russian-speaking threat actors. According to Securonix Threat Research, the final payload is injected into legitimate processes such as aspnet_compiler.exe, masking malicious activity behind normal system operations.

The researchers also urge organisations to tighten monitoring of MSBuild.exe and legitimate system binaries like RegSvcs.exe and RegAsm.exe, and to promote user awareness to prevent clicking on deceptive error pages. 6 January 2026. According to Securonix Threat Research.