storm-1865

Storm-1865 is a sophisticated phishing campaign identified by Microsoft Threat Intelligence, primarily targeting the hospitality sector through impersonation of Booking.com. The campaign, active since December and continuing into February, uses social engineering tactics like ClickFix to trick users into downloading credential-stealing malware. Windows users, especially those in hospitality, should be aware of emails that appear to be from Booking.com scolding about an angry guest, as these are designed to harvest credentials and keystrokes. The threat involves bypassing conventional defenses to deliver malicious payloads, making it critical for organizations to stay informed and implement protective measures.