Booking.com ClickFix to NetSupport RAT

Summary

Recorded Future's Insikt Group published this on 25 March 2026 as one of five ClickFix clusters. Active from February 2026, it imitates Booking.com: a counterfeit reCAPTCHA asks the visitor to pick every picture of a bucket, always the same photos in the same order, and a verification page then puts a PowerShell command on the clipboard and asks for it to be pasted into the Run dialog. The script pulls four files from a staging host into a folder named with the same romantic-word scheme as Insikt's QuickBooks cluster, unpacks NetSupport RAT from a 7-Zip archive and adds a Startup link. Staging hosts differ between landing domains, but Insikt found the installs converging on shared NetSupport C2, and every landing domain it lists resolved to one hosting address.

Overlap with other campaigns

We compared the 26 indicators in this record — covering 20 distinct registrable domains — against the 60 other published campaigns in this corpus.

• QuickBooks-themed ClickFix to NetSupport

  2026-10-11

  1 of the 26 indicators in Booking.com ClickFix to NetSupport RAT also appear in this campaign.

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 3 of these mechanisms appear together in 15 of the 61 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

26 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.