Booking.com phish uses fake CAPTCHAs to trick hotel staff into downloading malware

ThreatDown and Malwarebytes report a phishing campaign that sends spoofed Booking.com emails to hotel staff; when recipients copy-and-paste the provided link they land on a fake CAPTCHA page that instructs them to paste an mshta command into Windows Run, which then fetches and executes an information-stealing Trojan aimed at stealing guest payment and personal data.