This threat involves a phishing scam dubbed the “I Paid Twice” scam, which targets users of Booking.com and other online booking platforms. The scam convinces victims that they have been charged twice for their bookings, prompting them to click on malicious links or download files purportedly to resolve the issue. These links or downloads deliver PureRAT, a remote access trojan (RAT) that allows attackers to gain persistent, unauthorized access to infected systems. PureRAT can exfiltrate sensitive information, including credentials, personal data, and financial details, and may facilitate further lateral movement within compromised networks. The malware is distributed via a tool or method referred to as ClickFix, which likely serves as the delivery mechanism or social engineering lure. The attack leverages social engineering to exploit user trust in reputable booking platforms, bypassing technical controls by relying on user interaction. Although no widespread exploitation has been reported yet, the scam's potential impact is considerable due to the sensitive nature of the targeted users and the capabilities of PureRAT. The phishing campaign is disseminated through email or possibly fake websites mimicking legitimate booking services. The technical details are limited, but the threat is confirmed through a Reddit InfoSec news post linking to an external article, indicating emerging awareness but minimal current discussion or exploitation. The scam's success depends on deceiving users into executing the malware payload, highlighting the importance of user vigilance and robust endpoint protection.

For European organizations, the impact of this threat includes potential compromise of employee and customer credentials, unauthorized access to corporate networks, and data breaches involving sensitive personal and financial information. Organizations in the travel, hospitality, and financial sectors are particularly vulnerable due to their direct interaction with booking platforms and payment processing. The infection of endpoints with PureRAT can lead to persistent backdoors, enabling attackers to conduct espionage, data theft, or deploy additional malware such as ransomware. The scam can also damage brand reputation and customer trust if users associate the organization with fraudulent activity. Given the high volume of travel-related transactions in Europe and the reliance on platforms like Booking.com, the threat poses a significant risk to both individual users and enterprises. The phishing vector and requirement for user interaction limit the scope somewhat, but the widespread use of these services increases the potential victim pool. Additionally, the timing of attacks around peak travel seasons could amplify the impact. The threat may also affect supply chains and third-party vendors connected to booking platforms, further extending its reach.

European organizations should implement targeted user awareness campaigns focusing on phishing scams related to travel bookings, emphasizing verification of payment claims through official channels only. Deploy advanced email filtering solutions capable of detecting and quarantining phishing emails with malicious links or attachments related to booking scams. Utilize web filtering to block access to known malicious domains and URLs associated with ClickFix or PureRAT distribution. Enforce multi-factor authentication (MFA) on all accounts related to booking platforms and corporate email to reduce the risk of credential compromise. Monitor network traffic and endpoint behavior for indicators of PureRAT infection, such as unusual outbound connections or persistence mechanisms. Regularly update and patch endpoint security solutions to detect and remediate RAT infections promptly. Encourage users to report suspicious emails or messages immediately and establish clear incident response procedures for potential infections. Collaborate with booking platforms to share threat intelligence and verify suspicious transactions. Finally, conduct periodic simulated phishing exercises tailored to travel-related scams to improve user resilience.