Dans un article de blog publié le 5 janvier 2026, les chercheurs de l’entreprise de cybersécurité Securonix mettent en lumière une nouvelle campagne cybercriminelle visant en particulier les établisse...

A Holiday-Season Threat Aimed at Hospitality As Europe’s hospitality sector enters its busiest travel period, cybercriminals are exploiting the surge in online bookings with a highly deceptive phishing campaign. Dubbed PHALTBLYX, this operation specifically targets hotels and hospitality businesses, abusing trust in well-known booking platforms and combining it with an unusual form of user-driven malware execution. The campaign demonstrates how social engineering, rather than technical exploits alone, continues to be one of the most effective tools in modern cybercrime.

The PHALT#BLYX campaign, active in late December 2025, targets the European hospitality sector through a sophisticated social engineering scheme. Threat actors impersonate Booking.com via fraudulent emails, redirecting employees to counterfeit Blue Screen of Death (BSoD) pages. These pages employ ClickFix lures, prompting users to apply supposed "fixes" that actually deploy DCRat, a remote access Trojan (RAT). This multi-step attack exploits human psychology and urgency to bypass technical defenses. While specific victims and detailed impacts remain undisclosed, the campaign underscores the persistent threat of social engineering in cybersecurity. The use of familiar and urgent scenarios, such as BSoD errors, effectively manipulates users into executing malicious payloads. Organizations in the hospitality sector should prioritize employee training to recognize and respond to such tactics. Implementing robust endpoint protection and multi-factor authentication can further mitigate risks associated with this and similar campaigns.

Securonix cybersecurity researchers have uncovered a new targeted campaign, designated PHALT#BLYX, specifically aimed at the European hotel industry. The attack sequence begins with deceptive emails that mimic legitimate hotel reservation communications. These emails contain malicious links or attachments that, when interacted with, redirect victims to counterfeit Blue Screen of Death (BSoD) error pages. This technique, leveraging ClickFix lures, is designed to exploit the natural urgency users feel when confronted with system failure messages, thereby increasing the likelihood of successful compromise. The campaign is characterized as multi-stage, with the ultimate objective of deploying the DCRat remote access trojan (RAT) on infected systems. DCRat is a commodity malware known for its remote access capabilities, which can be used for data exfiltration, system control, and further malware deployment. The choice of the hospitality sector as a target is noteworthy, as hotels frequently handle sensitive guest information and may have varying levels of cybersecurity maturity. While the source material does not disclose specific dates or details about affected organizations, the campaign underscores the persistent effectiveness of social engineering tactics in cyber attacks. The use of BSoD lures represents a calculated attempt to bypass user skepticism, as victims may be more inclined to follow instructions presented in what appears to be a critical system error message. Defending against such campaigns requires a combination of technical controls, including advanced email filtering and endpoint protection, as well as regular security awareness training for employees. The multi-stage nature of the PHALT#BLYX campaign suggests a methodical and potentially sophisticated threat actor, though no attribution is provided in the available information. It is critical for organizations in the hotel sector to review their incident response plans and ensure that employees are trained to recognize and report suspicious emails, particularly those that attempt to create a sense of urgency. However, it should be noted that the original source article, dated January 2026, could not be accessed for verification purposes. Therefore, this analysis is based solely on the information provided in the initial message, and some details may be incomplete or subject to change upon further investigation.