Fake BSOD Lures and Trusted Build Tools Power DCRat Deployment

A sophisticated malware campaign tracked as PHALT#BLYX is targeting European hospitality organizations with fake Booking.com reservation cancellations, leveraging fake Blue Screen of Death (BSOD) simulations and trusted Windows build tools to deploy a customized DCRat payload while evading modern endpoint defenses.

The multi-stage attack begins with phishing emails impersonating Booking.com cancellation alerts, featuring urgent financial charges in Euros (typically exceeding €1,000) to induce panic.

Victims who click “See Details” are redirected via an intermediate domain before landing on a high-fidelity Booking.com clone that initiates the compromise chain.

Security researchers have attributed the campaign to Russian-speaking threat actors based on Cyrillic debug strings embedded in the attack infrastructure, including phrases like “Попытка $attempt из $maxAttempts” (Attempt X of Y) and “Установка успершно завершена” (Installation successfully completed).

The ClickFix Infection Chain

The attack employs a “ClickFix” social engineering technique that transforms victims into active participants in their own compromise.

Securonix Threat Research identified this campaign as an evolution from earlier PHALT#BLYX samples that used HTML Application (.hta) files executed via mshta.exe.

After clicking a fake “Refresh page” button on the malicious landing page, the browser displays a full-screen BSOD simulation.

A troubleshooting prompt instructs users to press Windows+R, then Ctrl+V, then Enter ostensibly to fix the error. This sequence executes a malicious PowerShell script that was silently copied to the clipboard, bypassing automated security controls.

The PowerShell dropper performs three critical actions: it opens a legitimate Booking.com admin page as a decoy, locates MSBuild.exe on the system, and downloads a malicious project file (v.proj) from https://2fa-bns[.com/.

Using MSBuild a trusted Microsoft binary the attackers compile and execute their payload, effectively living off the land to evade application allowlisting and antivirus detection.

Deploying the final payload, the MSBuild project file aggressively disables Windows Defender by adding the C:\ProgramData directory and multiple file extensions (.exe, .ps1, .proj, .tmp) to the exclusion list.

If running with administrator privileges, the malware disables real-time monitoring entirely using Set-MpPreference. For standard users, it employs “UAC Spam” repeatedly triggering elevation prompts up to three times to fatigue victims into granting access.

Persistence is established through an unconventional method: an Internet Shortcut file (DeleteApp.url) placed in the Startup folder.

Masquerading as an uninstaller, this .url file points to C:\Windows\Temp\tybd7.exe, ensuring the malware executes on each login while appearing benign to casual inspection.

DCRat Payload Analysis

The final payload (staxs.exe) is a .NET loader packed with Costura.Fody that injects the actual RAT into aspnet_compiler.exe through process hollowing.

The configuration is encrypted with AES-256-CBC using PBKDF2 key derivation (50,000 iterations) with a static salt “LoaderPanel”, revealing three C2 domains: asj77[.com, asj88[.com, and asj99[.com communicating on port 3535.

The malware gathers comprehensive system intelligence including hardware ID, username, OS version, administrative privileges, active window titles, antivirus software, domain membership, and installation timestamp.

It maintains connections through randomized 10-15 second heartbeats and supports commands for remote desktop streaming, keylogging, reverse shell access, and in-memory execution of secondary payloads.

The shift to MSBuild-based delivery represents a strategic pivot toward more evasive living-off-the-land techniques, reducing detection by antivirus vendors and automated security controls while maintaining effectiveness against hospitality sector targets.

Organizations should educate employees about ClickFix tactics and warn against pasting scripts into Run dialogs or PowerShell terminals. PowerShell Script Block Logging should be enabled to capture executed script contents.

Security teams must monitor MSBuild.exe for unusual behavior, particularly when executing project files from non-standard directories like %ProgramData%.

Process injection detection should focus on legitimate binaries like aspnet_compiler.exe making outbound connections to unknown IPs on non-standard ports.

File system monitoring should track creation of .proj and .url files in sensitive locations, while browser protections should be enhanced to block access to the identified malicious domains.

The PHALT#BLYX campaign demonstrates how commodity malware continues evolving to bypass modern defenses through trusted tool abuse, psychological manipulation, and sophisticated evasion techniques, requiring behavioral analysis and process lineage monitoring rather than traditional file-based detection alone.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.