Russian hackers fake BSOD error on fake Booking.com sites to spread viruses

Cybercriminals are using a social engineering technique known as ClickFix to spread malware through a fake Windows blue screen of death, or BSOD. The campaign, identified by security firm Securonix as PHALT#BLYX, primarily targets the hospitality industry at Europa, starting with phishing emails that mimic notifications from Booking.com about reservation cancellations.

Victims receive urgent fake messages about canceled reservations, with links leading to copycat pages of the booking site. When accessing these pages, users are faced with simulated error messages, followed by a full blue screen animation that takes over the entire browser, instructing them to execute commands to fix the supposed critical issue.

This approach exploits the immediate recognition of BSOD as a sign of a serious system failure, leading less experienced users to follow malicious directions without question. The method convinces victims to copy and paste scripts into the Executar dialog of Windows, initiating the infection.

How the attack works step by step

Attackers send phishing emails disguised as official communications from Booking.com, warning of cancellations or reservation issues. Esses emails include buttons to verify details, which redirect to highly convincing fake websites.

When loading the fake page, a long loading message appears, encouraging you to click a refresh button. Essa action activates the blue screen simulation, with detailed instructions for pressing key combinations and pasting commands.

• The malicious script is automatically copied to the clipboard.
• By following the directions, the user runs a PowerShell command that downloads additional files.
• Then, legitimate Windows tools such as MSBuild compile and execute the embedded payload.

This multistage chain allows you to bypass basic defenses, as it uses trusted operating system processes.

Details of installed malware

The final payload is DCRat, a remote access trojan associated with Russian or Russian-speaking groups. Esse malware grants complete control to the attacker, allowing remote monitoring and execution of additional commands.

Once installed, DCRat disables Windows Defender to avoid detection, adds antivirus exclusions, and establishes persistence through files in the boot directory. Ele also repeatedly attempts to elevate privileges, prompting Controle, Conta, and Usuário until administrative permission is obtained.

The trojan collects system information such as hardware, installed software, and active window titles. Além additionally steals clipboard data, credentials and allows injection of other malware.

Experts note that the use of native Windows tools makes it difficult to identify by traditional security solutions.

Hotel sector as main target

The campaign focuses on employees of hotels and hospitality companies in Europa, exploring the urgency typical of this environment. Reservas and cancellations are common themes, increasing the credibility of fake emails.

The timing coincides with periods of high demand, such as holidays, when teams deal with a higher volume of queries. Ataques similar to ClickFix have already explored trusted brands, but this variant with BSOD represents an evolution in sophistication.

Researchers indicate links to Russian actors, based on the language in parts of the code and the use of DCRat, previously associated with campaigns against specific targets.

Recommended prevention measures

Users should be wary of unexpected booking messages by checking directly on the official Booking.com website. Evite click on email links; enter the address manually into the browser.

In case of suspicious browser errors, close it completely instead of following on-screen instructions. Telas real BSOD cases do not offer detailed recovery steps with commands to execute.

• Update systems and antivirus regularly.
• Enable phishing protections in browsers.
• Train teams on social engineering.
• Use multi-factor authentication on critical accounts.

Companies in the hospitality sector can implement advanced filters on emails and monitor suspicious traffic.

Evolution of ClickFix tactics

The ClickFix technique has gained popularity since 2024, with variants simulating browser updates or fake CAPTCHAs. Essa version incorporates the BSOD to increase the sense of urgency and panic.

Unlike automatic infections, the method depends on the victim’s manual action, reducing chances of early detection by automated tools. The combination with themed lures makes the attack more targeted and effective.

Analysts predict similar variations exploring other popular brands in vulnerable sectors.

Technical characteristics of the campaign

The domain used for hosting includes elements such as 2fa-bns.com, registered to hide malicious activities. The initial PowerShell downloads an MSBuild project that executes the payload in memory, using process hollowing in legitimate processes.

Persistence occurs via .url file in the Startup folder, ensuring execution after restarts. The malware checks privileges and insists on elevation if necessary.