Storm-1865 used ClickFix and Booking.com lures against hotels
Fake CAPTCHA pages pushed mshta commands that installed stealers and RATs; Booking.com says its own systems were not breached.
36
Threat actor
Storm-1865
- Mentions · 7d1
- Mentions · 30d1
- All mentions1
- First seenOct 26, 2026
- Last mentioned4d ago
Timeline
1 articles · newest firstAppears with
- Lumma Stealermalware · 1
- US Federal Trade Commissionorganization · 1
- Booking.comvictim · 1
- XWormmalware · 1
- NetSupport RATmalware · 1
- Cybleorganization · 1
- AsyncRATmalware · 1
- VenomRATmalware · 1
- Danabotmalware · 1
- Microsoftorganization · 1
- Booking.comproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.