ClickFix Campaign Targets Hotels, Spurs Secondary Customer Attacks

Researchers have uncovered a broad ClickFix campaign that targets hotels with infostealing and RAT malware, and then uses stolen data to mount secondary attacks against customers, with the aim of banking fraud. According to Sekoia[.]io, the activity began around April and remained active at least until October 2025, involving a campaign that enables theft of professional credentials granting access to booking platforms such as Booking[.]com and Expedia.

The attackers use a compromised hotel Booking[.]com email account or WhatsApp messages to deliver phishing attempts that reference guest matters and lure victims with a From header spoof to impersonate Booking[.]com. The chain redirects to a ClickFix page that prompts users to copy a malicious PowerShell command, leading to the deployment of infostealing and a remote access Trojan known as PureRAT, which provides extensive capabilities including data exfiltration and remote control.

Downstream attacks target customers via WhatsApp or email using legitimate reservation details to solicit banking information, with phishing pages mimicking Booking[.]com typography to harvest data. The campaign is supported by hundreds of malicious domains active for several months as of October 2025, illustrating a persistent and reportedly profitable operation.