Blue Screen of Death Scam: How to Recognize and Remove It
- A novel cyberattack is spreading across Europe, tricking users with a convincing fake Windows "Blue Screen of death" (BSOD) to gain control of thier computers.
- Security researchers at Trend Micro first detailed the campaign on January 8, 2026.
- According to Trend micro's analysis, the command prompt, when executed, downloads and installs remote access trojans (RATs) onto the victim's machine.
New Cyberattack Uses Fake Windows ‘Blue Screen of Death’ to Hack European Users
A novel cyberattack is spreading across Europe, tricking users with a convincing fake Windows “Blue Screen of death” (BSOD) to gain control of thier computers. The attack, disguised as an email from Booking.com,prompts victims to execute a malicious command.
Security researchers at Trend Micro first detailed the campaign on January 8, 2026. The email claims to contain booking confirmations and includes a malicious attachment. When opened, the attachment displays a realistic-looking BSOD screen. Though, this isn’t a system crash; it’s a deceptive tactic designed to scare users into running a command-line prompt.
According to Trend micro’s analysis, the command prompt, when executed, downloads and installs remote access trojans (RATs) onto the victim’s machine. These RATs allow attackers to steal data, monitor activity, and potentially deploy further malware.
“The attackers are leveraging the fear associated with the BSOD to trick users into executing malicious commands,” stated a Trend Micro blog post. “This is a particularly clever technique as it bypasses typical security awareness training that focuses on identifying phishing emails.”
The attack primarily targets users in Europe,but the potential for wider distribution exists. security experts recommend users exercise caution when opening attachments from unknown senders, even if the email appears to be from a legitimate source like Booking.com. Booking.com has not yet issued an official statement regarding the attack, but Trend Micro is working with the company to mitigate the threat.
Users are advised to keep their operating systems and security software up to date and to report any suspicious emails to their IT departments or local authorities.