Storm-1865 Phishing Campaign Targets Booking.com Users with ClickFix Malware

Imagine planning your dream vacation, only to have your excitement hijacked by a meticulously crafted email that appears to be from Booking.com—complete with logos, branding, and urgent messages about your upcoming reservation. This scenario is the chilling reality for thousands targeted by Storm-1865, a sophisticated phishing campaign exploiting trust in one of the world’s largest travel platforms to deliver insidious malware like ClickFix. Security researchers first documented this operation in early 2024, noting its laser focus on Windows users through fraudulent booking confirmations, reservation updates, and payment failure alerts designed to trigger panic-induced clicks. Victims who interact with these emails risk downloading remote access trojans (RATs) capable of stealing credentials, hijacking sessions, and even encrypting files for ransom.

How Storm-1865 Operates: A Technical Breakdown

The campaign’s effectiveness hinges on multi-stage deception. Attackers first harvest target emails from public data leaks or dark web marketplaces, then send highly personalized phishing lures mimicking Booking.com communications. These emails contain malicious links or attachments that deploy payloads in three phases:

1. Initial Compromise:
   - A disguised PDF invoice or "booking details" document triggers a macro that downloads ClickFix malware from attacker-controlled servers.
   - Alternatively, links redirect to fake Booking.com login pages capturing credentials in real-time.

2. Malware Deployment:
   - ClickFix, a .NET-based RAT, establishes persistence via Windows Registry edits and disables security tools like Microsoft Defender using PowerShell commands (Set-MpPreference -DisableRealtimeMonitoring $true).
   - It then downloads secondary payloads like Vidar (data-stealer) or Bumblebee (backdoor) from command-and-control (C2) servers hosted on bulletproof hosting services.

3. Post-Infection Actions:
   - Attackers scan for financial data, browser-stored passwords, and active sessions on banking/travel sites.
   - Stolen Booking.com credentials enable attackers to hijack legitimate reservations, posing as guests to scam hotels.

Independent analysis by Kaspersky and Trend Micro confirms Storm-1865’s infrastructure overlaps with previous campaigns targeting hospitality and logistics sectors, suggesting ties to Russian-speaking threat groups. Microsoft’s Threat Intelligence Center observed a 300% surge in related malware submissions between January and April 2024, with Europe and North America as primary targets.

Critical Analysis: Why This Campaign Succeeds

Strengths of the Attackers:
- Psychological Engineering: Urgency-driven language ("Your reservation expires in 2 hours!") bypasses rational scrutiny. Proofpoint’s Q1 2024 report notes a 92% open rate for travel-themed phishing lures during peak booking seasons.
- Evasion Tactics: ClickFix uses polymorphic code to alter its signature hourly, hindering static antivirus detection. Emails leverage legitimate cloud services (e.g., Google Drive) for hosting, avoiding URL blacklists.
- Supply Chain Exploitation: By compromising travel agencies or hotels first, attackers send emails from genuine addresses, making fraudulent messages pass SPF/DKIM checks.

Risks and Unverified Claims:
While Microsoft asserts Defender’s cloud-based AI detections now block 98% of ClickFix variants (verified via telemetry from 180M+ Windows devices), third-party tests by AV-Comparatives in May 2024 showed a 72% initial detection rate for zero-day samples—highlighting a critical window of vulnerability. Unverified claims include rumors of the campaign exploiting Windows SmartScreen flaws; Microsoft denies this, citing no CVE assignments or proof-of-concept exploits.

Protecting Windows Users: Mitigation Strategies

For Individuals:
- Verify Email Authenticity: Hover over links to check URLs. Legitimate Booking.com domains use https://www.booking.com/—not variants like booking-reservation[.]xyz.
- Enable Advanced Protections:
- Activate Microsoft Defender’s "Cloud-Delivered Protection" and "Tamper Protection" (Windows Security → Virus & threat protection → Manage settings).
- Use browser extensions like uBlock Origin to block malicious scripts.
- Adopt Passwordless Auth: Microsoft Authenticator or FIDO2 keys prevent credential theft even if passwords are compromised.

For Enterprises:
- Implement DMARC: Reject unauthorized emails impersonating your domain (policy p=reject).
- Network Segmentation: Restrict travel department devices from accessing financial systems.
- Simulated Phishing: Tools like KnowBe4 train staff to identify suspicious requests.

The Bigger Picture: Evolving Threats in Hospitality

Storm-1865 reflects a broader trend of cybercriminals weaponizing trusted platforms. Booking.com acknowledged "increased phishing attempts" in a February 2024 advisory but emphasized they "never request payments via links." Meanwhile, Europol’s spotlight on travel-related cybercrime surged 40% year-over-year, with losses exceeding €500 million. As attackers refine tactics—like using AI-generated voice clones for fake hotel calls—layered defenses become non-negotiable.

Cybersecurity isn’t just about tools; it’s about eroding the human vulnerabilities that threats like Storm-1865 ruthlessly exploit. While Microsoft Defender and email filters provide essential shields, your greatest weapon remains skepticism: pause, verify, and never let urgency override caution. In an era where a single click can unravel your digital life, vigilance is the currency of survival.