Hospitality Sector Hit By PHALT#BLYX ClickFix Malware Campaign

Securonix observed a multi-stage phishing campaign (PHALT#BLYX) targeting hospitality organizations during the holiday season: Booking.com-themed emails redirect victims to cloned sites that prompt users to paste a PowerShell command, which downloads a project file executed by MSBuild.exe (living-off-the-land) and installs an obfuscated DCRat remote-access trojan capable of keylogging, process injection, persistence via Internet Shortcut files, and altering Defender exclusions; researchers attribute the activity to Russian-speaking actors and recommend user training, monitoring of trusted binaries (like MSBuild.exe), and behavioral/process-level detection.