--- title: How Cyble Brand Intelligence Could Have Helped Against... description: A phishing campaign tracked by Microsoft as Storm-1865 impersonated Booking.com to target hotel and hospitality staff starting in December 2024. Victims saw... canonical: https://daily.dev/posts/how-cyble-brand-intelligence-could-have-helped-against-the-booking-com-clickfix-campaign-tgpdhqwhx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Cyble Brand Intelligence Could Have Helped Against The Booking.com ClickFix Campaign | daily.dev og:description: A phishing campaign tracked by Microsoft as Storm-1865 impersonated Booking.com to target hotel and hospitality staff starting in December 2024. Victims saw... og:url: https://daily.dev/posts/how-cyble-brand-intelligence-could-have-helped-against-the-booking-com-clickfix-campaign-tgpdhqwhx og:image: https://api.daily.dev/og/posts/TGPDHQwhx.png og:image:alt: How Cyble Brand Intelligence Could Have Helped Against The Booking.com ClickFix Campaign og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Cyble Brand Intelligence Could Have Helped Against The Booking.com ClickFix Campaign **[Cyble](https://daily.dev/sources/cyble)** · 7 min read · 0 upvotes · 0 comments ## Summary A phishing campaign tracked by Microsoft as Storm-1865 impersonated Booking.com to target hotel and hospitality staff starting in December 2024. Victims saw emails about negative guest reviews or account issues, landed on a copy of a Booking.com page with a fake CAPTCHA, and were told to paste a clipboard command into the Windows Run box. That command used mshta.exe to deliver malware including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT to steal credentials and payment data. Booking.com said its own systems weren't breached, but some partners and customers were hit. This is a vendor post from Cyble mapping its own brand-monitoring product to each stage of the attack as a promotional case study. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the ClickFix technique used in the Booking.com phishing campaign? ClickFix tricks victims into opening the Windows Run box and pasting a command that a fake CAPTCHA page has already copied to their clipboard. In the Booking.com impersonation campaign tracked by Microsoft as Storm-1865, that pasted command used mshta.exe to download malware such as XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT. _Teams hardening endpoints against clipboard-based lures can track these techniques as they evolve on daily.dev._ ### What malware was delivered in the Storm-1865 Booking.com phishing campaign? The campaign delivered a mix of commodity credential-stealing malware: XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT. Microsoft says all of these payloads were built to steal credentials and payment data from infected hotel and hospitality staff machines starting around December 2024. _Security teams tracking commodity stealer campaigns like this can follow updates on daily.dev._ ### Was Booking.com itself hacked in the 2025 ClickFix phishing campaign? No, Booking.com's own systems were not breached. The company told Infosecurity Magazine that its name was impersonated by attackers, but some of its accommodation partners and customers were hit by the resulting phishing and malware campaign run by the group Microsoft tracks as Storm-1865. _Anyone evaluating brand-impersonation risk can keep tabs on cases like this via daily.dev._ ## Similar posts on daily.dev - [Malware Campaign Abuses Booking.com Against Hospitality Sector](https://daily.dev/posts/malware-campaign-abuses-booking-com-against-hospitality-sector-fgjly8xvz) · Security Boulevard · 1 upvotes · 0 comments - [Fake Booking Emails Redirect Hotel Staff to Fake BSoD Pages Delivering DCRat](https://daily.dev/posts/fake-booking-emails-redirect-hotel-staff-to-fake-bsod-pages-delivering-dcrat-iortiv7gc) · The Hacker News · 0 upvotes · 0 comments - [Hotel staff tricked into installing malware by bogus BSODs](https://daily.dev/posts/hotel-staff-tricked-into-installing-malware-by-bogus-bsods-ly6vduz7o) · The Register · 0 upvotes · 0 comments - [Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware](https://daily.dev/posts/large-scale-clickfix-phishing-attacks-target-hotel-systems-with-purerat-malware-kc5f9td6d) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/how-cyble-brand-intelligence-could-have-helped-against-the-booking-com-clickfix-campaign-tgpdhqwhx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Cyble Brand Intelligence Could Have Helped Against The Booking.com ClickFix Campaign","url":"https://daily.dev/posts/how-cyble-brand-intelligence-could-have-helped-against-the-booking-com-clickfix-campaign-tgpdhqwhx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-cyble-brand-intelligence-could-have-helped-against-the-booking-com-clickfix-campaign-tgpdhqwhx"},"datePublished":"2026-10-26T11:08:42.190Z","dateModified":"2026-10-26T11:13:10.723Z","description":"A phishing campaign tracked by Microsoft as Storm-1865 impersonated Booking.com to target hotel and hospitality staff starting in December 2024. Victims saw...","image":"https://media.daily.dev/image/fetch/s--vadTB98p--/f_auto,pg_1,q_auto/https://cyble.com/wp-content/uploads/2026/10/five-steps-five-chances.gif?_a=BAMAMiiw0","thumbnailUrl":"https://media.daily.dev/image/fetch/s--vadTB98p--/f_auto,pg_1,q_auto/https://cyble.com/wp-content/uploads/2026/10/five-steps-five-chances.gif?_a=BAMAMiiw0","isAccessibleForFree":true,"articleSection":"Cyble","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cyble","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/345d6009096c4c2da164d9d8e6ccfbe6","url":"https://daily.dev/sources/cyble"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-cyble-brand-intelligence-could-have-helped-against-the-booking-com-clickfix-campaign-tgpdhqwhx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"phishing","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cyble","item":"https://daily.dev/sources/cyble"},{"@type":"ListItem","position":3,"name":"How Cyble Brand Intelligence Could Have Helped Against The Booking.com ClickFix Campaign"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-cyble-brand-intelligence-could-have-helped-against-the-booking-com-clickfix-campaign-tgpdhqwhx#faq","mainEntity":[{"@type":"Question","name":"What is the ClickFix technique used in the Booking.com phishing campaign?","acceptedAnswer":{"@type":"Answer","text":"ClickFix tricks victims into opening the Windows Run box and pasting a command that a fake CAPTCHA page has already copied to their clipboard. In the Booking.com impersonation campaign tracked by Microsoft as Storm-1865, that pasted command used mshta.exe to download malware such as XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT. Teams hardening endpoints against clipboard-based lures can track these techniques as they evolve on daily.dev."}},{"@type":"Question","name":"What malware was delivered in the Storm-1865 Booking.com phishing campaign?","acceptedAnswer":{"@type":"Answer","text":"The campaign delivered a mix of commodity credential-stealing malware: XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT. Microsoft says all of these payloads were built to steal credentials and payment data from infected hotel and hospitality staff machines starting around December 2024. Security teams tracking commodity stealer campaigns like this can follow updates on daily.dev."}},{"@type":"Question","name":"Was Booking.com itself hacked in the 2025 ClickFix phishing campaign?","acceptedAnswer":{"@type":"Answer","text":"No, Booking.com's own systems were not breached. The company told Infosecurity Magazine that its name was impersonated by attackers, but some of its accommodation partners and customers were hit by the resulting phishing and malware campaign run by the group Microsoft tracks as Storm-1865. Anyone evaluating brand-impersonation risk can keep tabs on cases like this via daily.dev."}}]} ```