Russian hackers target European hospitality industry with ‘blue screen of death’ malware

Researchers from Securonix observed a phishing campaign called PHALT#BLYX targeting European hotels and hospitality organizations by sending fake reservation cancellation emails that lead victims to a fake booking page and a staged Blue Screen of Death; victims are coerced to paste a malicious command that installs DCRat, disables Windows Defender, and steals credentials and clipboard data. The campaign leverages the “ClickFix” social-engineering technique and abuses trusted binaries like MSBuild.exe for stealth and persistence, and telemetry/strings suggest ties to Russian-speaking criminal actors.