Detecting an email-based ClickFix attack that delivers DCRat malware payload · Blog · Sublime Security

This Attack Spotlight details a phishing campaign that impersonated Booking.com and used a fake CAPTCHA to copy an obfuscated PowerShell command into the victim's clipboard; when pasted and executed via Windows+R the command retrieves and runs DCRat (SHA256 08037de4a729634fa818ddf03ddd27c28c89f42158af5ede71cf0ae2d78fa198), saved as C:\Windows\Temp\tybd7.exe. The report outlines the full delivery chain, sample loader script, C2 domains, IOCs, and detection signals, and notes that Sublime's detection engine prevented the attack.