A recent security investigation has uncovered an email campaign impersonating Booking.com to distribute malware using the ClickFix technique. This method has seen a growth of over 500% in 2025, using fake critical error screens to trick victims into disabling their system's defenses. The scam, which impersonates the Booking.com platform, directs users to malicious websites where remote access trojans are installed. The malware allows attackers to gain remote control of the computer, log keystrokes, and download additional payloads, such as cryptocurrency miners, facilitating data theft and propagation within local networks. To mitigate the risks associated with the ClickFix technique, experts recommend: thoroughly verifying the authenticity of received emails; refraining from executing unknown commands or following instructions from supposed browser error screens; implementing security solutions that block unauthorized downloads and detect the abuse of legitimate system tools; reinforcing training on social engineering, understanding that current threats rely on manipulating the human element.
