CLICKFIX ATTACK USES FAKE WINDOWS BSOD SCREENS TO PUSH MALWARE

Summary from the TLDR InfoSec newsletter

Securonix tracked a ClickFix campaign (PHALT#BLYX) targeting European hospitality firms through phishing emails impersonating Booking.com reservation cancellations, leading victims to a high-fidelity clone site that displays fake Windows BSOD screens in full-screen browser mode. The social engineering attack tricks users into executing malicious PowerShell commands that download and compile a .NET project using MSBuild.exe, thereby deploying the DCRAT remote access trojan, which includes keylogging, reverse shell, remote desktop functionality, and cryptocurrency mining. Hospitality organizations should implement email filtering for Booking.com impersonation attempts, educate staff that legitimate BSOD screens never provide recovery instructions or commands to execute, and monitor for suspicious MSBuild.exe compilation activity and Windows Defender exclusion modifications.