Booking.com ClickFix Phishing Campaign Delivers NetSupport RAT and zgRAT

Attackers are impersonating Booking.com pages in an ongoing ClickFix phishing campaign targeting the hospitality sector, tricking users into opening the Windows Run dialog and pasting attacker-supplied PowerShell that installs remote-access malware. Recent waves used Booking.com-branded lures such as secure-extranet[.]com, redirectors including jskeowgo[.]com, and additional phishing subdomains aimed at hotel staff, with some activity specifically targeting Italian-speaking users. Researchers observed multiple payload paths: one chain deployed NetSupport RAT through a large PowerShell stage that unpacked 14 base64-encoded components and then opened the legitimate Booking.com site to preserve the pretext, while another used staged loaders, ZIP delivery, and DLL sideloading via a legitimate psl.exe binary to install zgRAT and PureHVNC.

The malware provided full remote-control capability, including shell access, file transfer, keylogging, screen capture, and webcam or audio access, and established persistence through mechanisms such as Startup-folder shortcuts and HKCU\Run keys like SystemUpdate_<VID>. Infrastructure linked to the activity included freshly registered domains obtained in batches through Chinese and Hong Kong registrars, rotating download servers, telemetry endpoints that tracked installation progress per victim, and command-and-control systems hosted across providers in Frankfurt, Russia-linked environments, and a likely bulletproof-hosting setup tied to a newly created autonomous system. Investigators also found OPSEC clues including an exposed RDP certificate leaking the hostname WIN-FLJTJKL01VM, a PDB path referencing C:\Users\Administrator\Desktop\HTCTL32\, and malware signed with a stolen *.dodo.com wildcard certificate, supporting clustering of the campaign as a financially motivated cybercrime operation using commodity RAT tooling.