A malware campaign dubbed PHALT#BLYX is actively compromising hotel reservation systems across Europe, using a remote access trojan called DCRat that attackers install after tricking front-desk staff into running fake Windows repair files.

Researchers at cybersecurity firm Securonix confirmed the campaign. They attribute it to Russian-speaking cybercriminals and describe it as part of a broader effort to exploit weaknesses in the hospitality sector's online infrastructure.

How does the attack work?

The scheme starts with a pop-up on a hotel booking-counter PC. The alert claims a guest wants to cancel a reservation and offers the employee the choice to accept or decline, often promising a small fee reduction for accepting.

Either choice leads the employee to a malicious link. That link triggers a fake Windows "Blue Screen of Death" error. The crash screen is a deliberate distraction, designed to convince the employee the system has suffered a critical failure.

On-screen instructions then prompt the employee to download and install a file to fix the problem. That action activates DCRat on the machine.

What is DCRat and what can it do?

DCRat is a remote access tool. Once installed, it opens a backdoor into the system that lets attackers:

• Control the infected computer from a distance
• Monitor the victim's activities
• Steal sensitive data
• Gain control over the hotel's wider network

Securonix researchers warn the consequences range from direct financial losses to significant reputational damage for the affected business.

Which platforms distribute the attack?

The campaign spreads through search and booking platforms that hotel staff use daily to manage reservations and customer queries. Securonix identifies the distribution channels as:

• Google Hotel Search
• TripAdvisor
• Trivago
• Booking.com

These platforms' central role in daily hotel operations makes them prime targets for the attackers.

What should hotel operators do now?

The attack succeeds because it disguises itself as routine customer service. Front-desk staff and booking managers are the primary victims, so operators should train them to recognise the pattern: an unsolicited cancellation pop-up, a system crash, and a prompt to download a fix.

Securonix stresses that hotels must act proactively on three fronts: securing their networks, training staff on cybersecurity best practices, and implementing robust security measures against increasingly deceptive social-engineering attacks.

Securonix continues to track PHALT#BLYX as cybercriminals refine the campaign, and European hotel groups should expect further variants of the ClickFix technique targeting booking systems in the months ahead.