Storm-1865 uses Booking.com impersonation to target hotel staff

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Cyble's blog post: Booking.com impersonation was used by Storm-1865 to deliver a ClickFix phishing chain against hotel and hospitality staff.

Why it matters: Brand impersonation attacks matter to IAM and security teams because trust can be abused before endpoint controls or MFA ever see the malicious command.

By the numbers:

• The US Federal Trade Commission says people reported losing nearly $1 billion to business impersonators in 2025.

Context

Brand impersonation is a governance problem as much as a phishing problem: attackers borrow a trusted name, build believable infrastructure around it and rely on partners to make the first trust decision. In this campaign, the exposed surface was not Booking.com’s internal systems but the ecosystem around its name, which makes external monitoring a security control rather than a marketing concern.

ClickFix matters here because it turns a familiar web interaction into a clipboard-driven execution path. The attacker does not need to defeat a perimeter if the user can be convinced to paste a command, and that is why monitoring copied brand assets and lookalike domains belongs alongside email and endpoint controls.

Key questions

Q: Why do fake CAPTCHA challenges create such a reliable path to malware delivery?

A: Fake CAPTCHA prompts work because they exploit verification fatigue. Users are conditioned to move through repetitive anti-spam checks quickly, so they are more likely to follow hidden instructions, paste commands, and execute tools like PowerShell or mshta.exe without scrutiny. That turns a familiar trust cue into an execution path for infostealers and RATs.

Q: Why do lookalike verification domains create more risk than ordinary phishing pages?

A: They exploit an expected identity journey, so the victim is already primed to comply with the request. That lowers suspicion, increases data disclosure, and makes the fake page more effective at harvesting credentials, personal information, and payment details.

Q: How can security teams detect Brand Impersonation?

A: Security teams detect Brand Impersonation by monitoring for lookalike domains, copied logos and text, and fraudulent accounts or messages that borrow trusted names. Track domain registrations, certificate abuse, and social or email campaigns that target customers or staff. Validate sender identity, enforce DMARC where possible, and use takedown and reporting processes to remove impersonating infrastructure quickly.

Q: What should teams do after customer accounts are accessed with stolen credentials?

A: Teams should reset affected passwords, revoke active sessions, notify impacted users, and review whether recovery settings or secondary contact details were altered. They should also assess whether any sensitive personal data was exposed, monitor for follow-on fraud, and coordinate identity monitoring where appropriate. Fast containment matters because credential stuffing often succeeds before attackers attempt monetisation.

Technical breakdown

How fake CAPTCHA pages turn brand trust into execution

ClickFix chains use a fake verification page to get the user to run a command themselves. The page often mimics a legitimate site closely enough that the request feels routine, then places a command on the clipboard and instructs the user to paste it into the Windows Run dialog. That shifts the attack from a browser interaction to local command execution, which allows commodity malware loaders to start without exploiting a software vulnerability. The security failure is not technical sophistication alone, but the misuse of trust and habit at the user interface level. See the ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide.

Practical implication: Block or alert on user-driven command execution paths and treat clipboard-to-Run prompts as a phishing indicator.

Why lookalike domains matter before the payload runs

A lookalike domain is an infrastructure asset built to borrow a trusted brand, often through typos, homoglyphs or copied page structure. Once it exists, it can host lures, fake verification pages or redirected downloads long before defenders inside the target environment see any malicious payload. That makes registration-time monitoring valuable, because the domain itself is often the earliest durable signal available. In brand impersonation campaigns, the domain is not just hosting infrastructure. It is part of the deception layer and often the only part defenders can observe early. See the Phishing Guide.

Practical implication: Monitor new registrations and DNS patterns for brand abuse so takedown can happen before delivery begins.

How commodity malware follows a pasted command

Once the pasted command runs, the attacker typically uses built-in Windows tooling such as mshta.exe or scripting interpreters to fetch a second-stage payload. That payload may be a stealer, RAT or loader, depending on the campaign. Because the initial command is user-initiated, detection often depends on endpoint telemetry, script control and unusual process ancestry rather than exploit signatures. In a chain like this, the important question is not whether the malware is novel, but whether the execution sequence is visible and interruptible at the host level.

Practical implication: Correlate command-line, script and child-process telemetry so user-launched payload delivery stands out quickly.

Threat narrative

Attacker objective: The objective was to use a trusted brand to gain execution on hotel endpoints and steal credentials and payment data for follow-on fraud.

1. Entry began with Booking.com impersonation emails and PDFs that directed hotel staff to a fake verification page.
2. Credential access followed when the lure convinced users to paste a malicious command that launched mshta.exe and downloaded stealers and RATs.
3. Impact came from malware capable of stealing credentials and payment data, creating fraud risk for partners and customers.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Brand trust has become an attack surface: the decisive control gap in this campaign is not email delivery alone, but the inability to govern how a trusted name is copied outside the perimeter. Once the attacker can borrow the brand, every downstream lure gains credibility before any internal system is touched. That makes external brand intelligence a governance issue, not a communications issue, especially for organisations whose customers or partners rely on their name to make quick trust decisions.

ClickFix is a social engineering control failure, not just a phishing variant: the attack succeeds because the user is pushed from verification into local execution in one motion. The security model assumes users will recognise an unnatural request before they act, but the clipboard paste step collapses that assumption. Defenders need to treat the browser-to-Run transition as a distinct risk moment and monitor it accordingly.

Lookalike domain registration is the earliest measurable warning: the attacker had to build infrastructure before any payload could land, which creates an interception point that sits fully outside victim endpoints. That matters because once a page is live, the lure can be shared across regions and services quickly. Organisations that watch for copied brand assets and suspicious registrations can shorten the attacker’s useful life dramatically.

Hotel and hospitality ecosystems need shared trust models: the campaign shows that the brand owner is not the only party at risk; accommodation partners are often the first operational target. Their devices, inboxes and workflows inherit the trust of the brand without inheriting its controls, which is where the gap opens. A shared governance model for brand abuse response is now part of partner risk management.

What this signals

External brand monitoring is now part of attack surface management: when the attacker’s first move is to borrow a trusted name, the earliest signals appear in registries, cloned pages and social channels rather than on the victim endpoint. Security programmes that ignore those external signals will keep learning about the campaign only after users interact with it.

Partner ecosystems need faster abuse escalation paths: hotel groups, marketplaces and platform providers are all exposed when a brand is copied across inboxes and portals. The practical shift is from defending a single perimeter to coordinating response across the brand owner and the organisations that operate under its trust.

Phishing-resistant MFA still matters, but it is not the first line here: the campaign shows that the more important control is preventing users from reaching the execution step at all. Once a user is guided into pasting a command, the control problem has already moved from authentication to endpoint execution and post-compromise response.

For practitioners

• Strengthen brand impersonation monitoring Track domains, pages and social content that copy your brand, then triage new registrations and cloned assets as security events, not marketing noise. See the Phishing Guide.
• Treat fake verification flows as a control event Flag any site that instructs users to paste commands into Windows Run or similar local execution prompts, and route those cases into phishing response workflows.
• Correlate partner-reported lures with live infrastructure Use reports from customers, suppliers and partners to identify the active pages behind phishing messages, then prioritise takedown of the hosting domain and mirrored page.
• Watch for post-execution credential exposure Search for leaked partner logins, cookies and tokens after a successful lure, because the value of the campaign often appears after the initial malware drop.
• Build a cross-partner brand abuse response path Give accommodation partners a simple escalation route for suspicious messages that use your name, including who to contact, what evidence to preserve and how to report the URL.

Key takeaways

• Brand impersonation can be enough to create the initial foothold, even when the target’s own systems are not breached.
• The campaign’s value to attackers came from a multi-stage chain that used trusted naming, cloned pages and user-driven execution.
• The most effective defences combine external brand monitoring, rapid takedown and endpoint controls that interrupt pasted-command malware delivery.

Related NHI Mgmt Group resources: Phishing Guide · Infostealer Threat Guide · ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide

Key terms

• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• Homoglyph Domain: A homoglyph domain is a domain name that uses characters from different writing systems, or visually similar letters and numbers, to look like another domain. Attackers use it in phishing and spoofing, relying on users and systems to misread the address and trust the wrong site or service.
• Lookalike Domain: A lookalike domain is a web address designed to resemble a trusted brand closely enough to trick users into believing it is legitimate. In identity attacks, the domain becomes part of the deception layer, letting attackers capture credentials, identity details, or payments through a counterfeit flow.
• Brand Impersonation: Brand impersonation is the use of a company’s name, logo, or identity cues to deceive people into trusting a fake message, site, account, or service. In security terms, it is a social engineering and fraud tactic that exploits trusted brand signals to steal credentials, secrets, payments, or access.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps security and identity practitioners connect governance decisions to the controls that reduce exposure across modern access paths.