Threat Actor Impersonates Booking.com in Phishing Scheme

Microsoft disclosed an ongoing global phishing campaign by the actor Storm-1865 that uses a social-engineering technique dubbed "ClickFix" to impersonate Booking.com; victims are lured to paste commands into the Windows Run dialog from a fake verification page, causing the download of multiple malware families with credential- and financial-data-stealing capabilities targeting the hospitality sector across multiple regions. Microsoft and Booking.com advise users to verify senders, check URLs, and follow security hygiene while administrators should limit privileges to reduce impact.