Major phishing attack hits hotels with ingenious new scam that also spreads dangerous malware

• ClickFix phishing campaign targets hotels and guests with PureRAT malware
• Attackers exploit compromised Booking.com accounts and sell stolen credentials on dark web forums
• Guests tricked into fake Booking/Expedia sites, losing login and payment card data

Hotels and their guests are being targeted by a highly sophisticated ClickFix campaign aiming to deliver dangerous malware, steal login credentials, and make fraudulent wire transactions, experts have warned.

Cybersecurity researchers Sekoia revealed the attackers would first use random, compromised email accounts to mail hotels and different Booking.com account holders with a phishing message. The link in the message triggers a redirection chain that ultimately leads to a fake reCAPTCHA challenge, designed to get the victims to download and install a remote access trojan called PureRAT.