This threat involves a multi-stage phishing attack chain starting with a malicious webpage mimicking Booking.com's interface with a fake CAPTCHA. Victims are socially engineered into executing a PowerShell command that runs a script directly in memory, avoiding disk detection. The script performs system fingerprinting, downloads a ZIP payload from a remote server, and deploys it into user directories. Persistence is achieved through registry modifications and scheduled tasks. The attack code includes fallback mechanisms and sends telemetry data via Telegram, suggesting use of a pre-built attack kit. Indicators include domains and URLs hosting the payload. There is no CVE or vendor patch information available.

The attack can lead to unauthorized code execution on victim systems, persistence that survives reboots, and potential further payload execution. The use of fileless techniques and social engineering increases the difficulty of detection and mitigation. However, no known exploits in the wild or specific threat actor attribution is reported. The impact is medium severity given the attack complexity and persistence but lacks evidence of widespread exploitation or critical system compromise.

No official patch or vendor advisory is currently available for this threat. Organizations should educate users to recognize phishing attempts, especially fake CAPTCHAs and unsolicited PowerShell commands. Blocking known malicious domains and URLs associated with this campaign (e.g., hailmeinc.com, accountpulsecentre.help, wiosyrondaty.com) at network perimeter controls can reduce exposure. Monitoring for unusual PowerShell activity and scheduled task creation may help detect infection attempts. Patch status is not yet confirmed — check vendor advisories for updates.