ClickFix attack uses fake Windows BSOD screens to push malware

A phishing campaign targeting the hospitality sector in Europe impersonates Booking.com to lure victims to a cloned site that displays a fake Windows BSOD; victims are instructed to paste and execute a PowerShell command which compiles a malicious .NET project with MSBuild, deploys DCRAT (staxs.exe) via process hollowing, establishes persistence, disables Defender protections, and downloads further payloads (e.g., crypto miner) via BITS.