Microsoft Research Reveals – Phishing Campaign Impersonates Booking(.)com, Delivers a Suite of Credential-Stealing Malware

Microsoft Threat Intelligence documents an ongoing global phishing campaign (Storm-1865) impersonating Booking.com that leverages a ClickFix social-engineering flow to coerce hospitality employees into running commands which invoke mshta.exe to download various credential- and payment‑stealing malware families; the report supplies IOCs, detection guidance, hunting queries, and mitigation recommendations.