New ClickFix Attack Uses Fake BSOD to Trick Users into Running Malicious Code
Securonix threat researchers have identified a sophisticated malware campaign, named PHALT#BLYX, targeting the hospitality sector. This campaign utilizes a social engineering tactic known as "ClickFix".
Securonix threat researchers have identified a sophisticated malware campaign, named PHALT#BLYX, targeting the hospitality sector. This campaign utilizes a social engineering tactic known as "ClickFix".
The campaign specifically targets European organizations during the holiday season by leveraging fake Booking.com reservation cancellations to deploy a Russian-linked DCRat payload.
The infection chain starts with a phishing email, impersonating Booking.com, notifying recipients of a reservation cancellation with a significant financial charge. Upon clicking the "See Details" link, users are redirected to a fraudulent page mimicking the Booking.com interface. The page displays a fake "Loading is taking too long" error. Clicking "Refresh" triggers a simulated full-screen BSOD crash. An overlay instructs users to perform a "fix" by pressing specific key combinations, leading to the execution of a malicious PowerShell script.
This sequence bypasses automated email security filters by infecting the system via the Windows Run dialog.
Securonix threat researchers have identified a sophisticated malware campaign, named PHALT#BLYX, targeting the hospitality sector.
The attack chain is notable for its use of the "Blue Screen of Death" deception and the exploitation of the legitimate Windows tool MSBuild.exe to bypass security defenses.
Once the PowerShell script is executed, it downloads a project file which is compiled and executed using MSBuild.exe, allowing the malware to bypass application allowlisting and antivirus detection.
The malware adds exclusions to Windows Defender for the ProgramData directory. It establishes persistence by creating an Internet Shortcut file in the Startup folder, disguised as a cleanup script.
The final payload is a heavily obfuscated version of DCRat, capable of process hollowing, keylogging, and deploying secondary payloads. This RAT is injected into the legitimate aspnet_compiler.exe process to conceal its activity.
Cyrillic debug strings found within the project file, alongside the use of DCRat, suggest a link to Russian threat actors. These elements indicate the campaign's origin.
Based on reporting by GBHackers.