Ongoing Cyber Attack Mimic Booking.com to Spread Password-Stealing Malware

Microsoft Threat Intelligence has identified an ongoing phishing campaign that began in December 2024, targeting organizations in the hospitality industry by impersonating the online travel agency Booking.com.

The campaign, tracked as Storm-1865, employs a sophisticated social engineering technique called ClickFix to deliver credential-stealing malware designed to conduct financial fraud and theft.

This attack specifically targets hospitality organizations across North America, Oceania, South and Southeast Asia, and various European regions, focusing on individuals likely to work directly with Booking.com.

As of February 2025, the campaign remains active and continues to evolve its tactics to bypass conventional security measures.