A large-scale phishing operation exploiting Booking.com partner accounts has been uncovered by cybersecurity experts The latest Sekoia.io report, published today, detailed how cybercriminals compromised hotel systems and customer data through a sophisticated malware campaign active since at least April 2025. The intrusion began when attackers sent malicious emails from legitimate hotel accounts or impersonated Booking.com. Each message contained a link leading victims through a redirection chain before launching the so-called ClickFix social engineering tactic. Victims were prompted to execute a PowerShell command that downloaded malware, ultimately infecting systems with the PureRAT remote access Trojan. PureRAT allows attackers to remotely control infected machines, steal credentials,…