Fake Booking.com lures and BSoD scams spread DCRat in European hospitality sector

PHALT#BLYX is a late-December 2025 campaign targeting European hospitality organizations with Booking.com-themed phishing that routes victims through fake CAPTCHA/BSoD pages to execute malicious PowerShell and an MSBuild project (v.proj). The multi-stage chain deploys a packed .NET loader (staxs.exe) that decrypts configuration with AES-256/PBKDF2, installs DCRat (enabling remote access, keylogging, process hollowing, persistence via a Startup .url), and connects to C2 domains; Russian-language artifacts suggest Russian-speaking operators.