ClickFix Campaign Serves Up Fake Blue Screen of Death

PHALT#BLYX is a ClickFix-based campaign targeting the hospitality sector that lures victims with fake Booking.com reservation cancellation pages and fake captcha/BSOD prompts to execute PowerShell commands. The attackers use MSBuild.exe to compile a project file that deploys a heavily obfuscated DCRat (Dark Crystal RAT) capable of process hollowing, keylogging, persistence, and dropping secondary payloads; indicators include abuse of MSBuild, aspnet_compiler.exe and tampering of Windows Defender exclusions.