Ransomware gangs are forming ‘cartels’ – the risk of new attacks could increase
From 2024 to 2025, ClickFix, a specific phishing technique, has been observed to be rapidly increasing. According to reports, it has increased by almost four times. Hackers send you a link that appears to offer some kind of benefit, but the hacker’s trick is that as soon as you click on the link, they steal your login or password.
ClickFix has increased four times since last year, meaning that credential theft is increasing along with malware. ClickFix is a form of phishing, and attempts to steal logins/passwords with malware have become more common.
In December 2024, Microsoft’s Threat Intelligence department detected a phishing campaign targeting hospitality businesses. Scammers posed as online travel agencies, a common tactic, and used ClickFix to spread malware that could rob you of your money and steal your credentials. And, this campaign? It’s still ongoing. Frankly, scammers are ruthless.
Here’s how this trick works: ClickFix doesn’t just ask you to click a link. No, it manipulates you with fake error messages or pop-ups that exploit your desire to fix problems. You copy and paste a command, sounds harmless, right? You’re essentially letting malware into your system.
In this new scam, they force you to open Windows Run with a keyboard shortcut, paste whatever nonsense you find on the phishing page into your clipboard, and press the Run button. That’s it. Game over.
To avoid this attack, avoid clicking on unknown emails or links, enable two-step authentication on your accounts, and make employees aware of phishing attacks.
Microsoft Report: ClickFix Phishing Attack, Real Incidents
Getting into the details: This campaign was run by a hacking gang called Storm-1865, targeting hotels and travel agencies. They sent emails pretending to be from Booking.com, offering all sorts of inducements, bad guest reviews, new guest requests, “exclusive” promos, fake account verifications, you name it. It was all designed to trick people into clicking and letting the malware in.
Sometimes it was a link, sometimes a PDF. The emails were nice, like, you think it was actually Booking.com. But once you clicked, you were redirected to a fake site. The page had a fake CAPTCHA, and the whole thing was designed to look real. People believed it, followed the instructions, and they got infected.
After “verification,” you were asked to open Windows Run and paste some garbage. The command then runs, which then downloads/runs malware or steals your login.
In 2023, these scammers began targeting hotel guests. In 2024, they started targeting e-commerce shoppers. Now, they’re using ClickFix, which somehow bypasses common security standards.
Recommendations
Users can follow the tips below to avoid and detect phishing activity.
Double-check who’s sending you the email. If it looks wrong, it’s probably them.
If you’re suspicious, go directly to the company’s website or call them; don’t trust emails.
Is an email screaming “Take action immediately!” It’s probably a scam. Hover over links before clicking to see where they actually are.
And beware of typos, phishers are usually in a hurry and have poor spelling.
According to Microsoft, Storm-1865 is constantly sending phishing emails, trying to steal your payment information and use it to make secret purchases.
This isn’t new. They’ve been doing this since 2023; they’re just getting smarter. They’re not just limited to obscure email domains; no, they’re sending messages from Gmail, iCloud, and even travel or shopping sites you probably use.
Frequently Asked Questions
Clickfix is a phishing technique where attackers cleverly mislead users into executing malicious commands themselves. This results in either malware being installed on their system or their login details being stolen.
Attackers are now relying more on social engineering instead of directly sending malware. This allows them to easily bypass antivirus software or simple email security measures.
It all starts with a fake email or message. It contains a tempting offer, a warning, or an urgent message that compels the user to click on a link or open a file.
Because the user executes the command themselves, security tools don’t detect anything suspicious. Everything happens at the user’s hands, making detection very difficult.
Often, people in the hospitality industry, travel agencies, e-commerce users, and customer service representatives are targeted.
A cybercriminal group called Storm-1865, which has been active since 2023.
Often not. Because the user is executing the command themselves, traditional malware detection methods are ineffective.
Not completely, but even if credentials are stolen, it becomes easier to prevent account takeover. The damage is somewhat mitigated.
User awareness training is crucial. Strong email security and account monitoring are also necessary.
Call Now — 24/7 Ransomware Help
If you’re under attack, call now. We’ll start safe containment, preserve evidence, and stand up a clean landing zone. No contracts required to start.
Call 316‑712‑4006
I am at risk, Save me!