Threat actors are conducting targeted intrusion campaigns against organizations in the hospitality sector using a highly orchestrated, multi-stage infection chain. The operation combines sophisticated social engineering with deliberate abuse of trusted Microsoft framework components to deliver DCRat, a Russia-linked remote access Trojan (RAT) known for its extensive post-compromise functionality.

Security researchers at Securonix1 have tracked this activity under the campaign identifier PHALT#BLYX. The campaign relies on phishing emails impersonating legitimate Booking.com reservation cancellation notifications, exploiting the operational workflows of hospitality staff who routinely handle booking changes. These lures do not rely on conventional malicious attachments; instead, they employ the so-called ClickFix technique – a social engineering methodology that fabricates system errors to manipulate users into manually executing attacker-supplied commands.

The infection chain begins with a fraudulent webpage that presents a captcha-style verification step, followed by a simulated Windows “blue screen of death” (BSOD). This staged progression is designed to induce panic and create a perception of immediate system failure. Victims are instructed to follow on-screen remediation steps, which direct them to manually launch PowerShell and paste a provided command sequence. Rather than exploiting a software vulnerability, the attack succeeds by coercing the user into becoming an active participant in execution.

The PowerShell commands retrieve a malicious MSBuild project file from attacker-controlled infrastructure. This file acts as the initial loader and represents a critical pivot point in the attack. The campaign’s technical sophistication is most evident in its abuse of MSBuild.exe, the Microsoft Build Engine. As a digitally signed and trusted Windows component, MSBuild.exe is frequently permitted by application control policies and is less scrutinized by security tooling. By instructing MSBuild to compile and execute a malicious project file, the attackers proxy their payload execution through a legitimate framework process, effectively bypassing application whitelisting and reducing the likelihood of static or behavioral detection.

Within the MSBuild project file, the DCRat payload is heavily obfuscated and embedded as inline task code. Once executed, the malware provides a full-featured remote access capability set, including process hollowing for stealth, keystroke logging for credential harvesting, persistent command-and-control (C2) communication, and a modular architecture that allows operators to deploy additional plugins or secondary payloads as needed.

Attribution artifacts indicate a strong likelihood of Russian or Russian-speaking threat actor involvement. Targeting indicators include fraudulent booking pages denominated in euros, suggesting a European victim focus, while Russian-language strings embedded within the infrastructure and payload align with known DCRat development origins. Historically, DCRat was authored by a Russian developer and has been leveraged in prior campaigns attributed to the UAC-0200 threat cluster, particularly in operations targeting Ukrainian entities.

The PHALT#BLYX infection chain demonstrates a detailed understanding of modern endpoint detection and response (EDR) platforms. The MSBuild project structure is deliberately crafted to disguise malicious execution as legitimate compilation activity, blending into expected system behavior. Following execution, the attackers attempt to weaken host-based defenses by modifying Windows Defender configuration via PowerShell, adding directory paths and process exclusions to suppress real-time scanning and behavioral inspection.

Rather than deploying a conventional on-disk executable, the final-stage payload is injected directly into the memory space of trusted .NET framework binaries, most notably aspnet_compiler.exe. This living-off-the-land binary (LOLBin) technique allows malicious code to operate under the guise of legitimate ASP.NET compilation activity, obscuring both process lineage and outbound network traffic. Additional observed injection targets include RegSvcs.exe and RegAsm.exe, both legitimate .NET assembly registration utilities that provide similar evasion advantages when abused for in-memory execution.

AI cyber threats in 2026Mitigation requires a combined focus on human and technical controls. User awareness training must explicitly reinforce that legitimate operating systems, browsers, and enterprise applications never require users to manually execute PowerShell or command-line scripts in response to error messages or web-based prompts. Hospitality personnel responsible for reservations and customer communications should be trained to treat urgent cancellation notices, payment disputes, or system error claims with heightened skepticism, especially when links or instructions deviate from established platform workflows.

Securonix1 is a privately held cybersecurity company that provides cloud-native platforms for threat detection, investigation, and response. Founded in 2008, it is recognized as a leader in security analytics and autonomous cyber operations, leveraging artificial intelligence to help enterprises combat evolving digital threats.

References