Phishing Campaign Targets EU Hospitality with Fake Booking.com Emails

Cybersecurity researchers have uncovered a sophisticated phishing campaign targeting Europe's hospitality sector, using fake Booking.com emails to trick employees into installing a remote access trojan during the busy holiday travel period.

The operation, tracked as PHALTBLYX, begins with emails mimicking reservation cancellation notices from Booking.com. These messages alert recipients to high-value room charges, often exceeding 1,000 euros, and urge them to click a "See Details" link for assistance with refunds. The link redirects users to a cloned Booking.com website designed to replicate the legitimate site's appearance, including colors, logos, and fonts.

Upon arrival, visitors encounter a simulated browser error, such as a fake CAPTCHA prompt or loading delay, prompting them to click a "Refresh Page" button. This action triggers the browser to enter fullscreen mode and display a fabricated Blue Screen of Death, a common Windows error screen. The fake BSOD includes instructions for recovery, directing users to open the Windows Run dialog and paste a preloaded PowerShell command from their clipboard.

Executing the command downloads a malicious project file, which is then...