Phishing campaign impersonates Booking .com, delivers a suite of credential-stealing malware

Microsoft Threat Intelligence details an ongoing Storm-1865 phishing campaign (active since Dec 2024 and observed into Feb 2025) that impersonates Booking.com and uses the ClickFix social-engineering method to trick hospitality-sector staff into pasting and running commands (via mshta.exe) which fetch multiple credential- and payment‑stealing malware families; the report includes indicators (C2 IPs and SHA-256 hashes), detection hunts, and mitigation recommendations.