Storm-1865 used ClickFix and Booking.com lures against hotels
Original title: Know How Cyble Brand Intelligence Can Help Stop ClickFix Campaigns in its Tracks
Fake CAPTCHA pages pushed mshta commands that installed stealers and RATs; Booking.com says its own systems were not breached.
Microsoft tracks Storm-1865 impersonating Booking.com from December 2024 to target hotel staff in North America, Europe, Oceania and parts of Asia, with the campaign still running as of February 2025. Emails and PDFs led to fake CAPTCHA pages that instructed staff to paste a clipboard command, which used mshta.exe to fetch credential- and payment-stealing malware. Booking.com told Infosecurity Magazine its systems were not breached, though some partners and customers were hit. Cyble maps each stage to its brand-protection product and says it is not claiming it took part in the response.
Unconfirmed: Cyble’s step-by-step detection claims are a capability mapping, not evidence it detected this campaign.
- Microsoft published its findings on March 13, 2025.
- Payloads included XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT.
- The group previously targeted Booking.com guests in 2023 and e-commerce buyers in 2024.
- Some lures arrived through Gmail, iCloud Mail and vendor platforms.
- FTC figures cited put 2025 business-impersonator losses near $1 billion.
Impact: Stolen hotel-staff credentials and payment data for fraud
- 1.Apply Microsoft’s recommended email filtering, endpoint detection, script controls and phishing-resistant MFA.
- Products
- Booking.com
- Threat actors
- Storm-1865
- Victims
- Booking.com
- Organizations
- MicrosoftCybleUS Federal Trade Commission
From the original article
6 min read at cyble.com
Booking. com's systems were never breached. Its name was.
By Mihir Bagwe · cyble.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.