Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant

Microsoft has issued a warning about an active phishing campaign targeting hotels and hospitality organizations across Europe and Asia since April 2026. The campaign uses photo-themed ZIP files to deliver a Node.js implant, tracked as TonRAT, which compromises front-desk machines.

The phishing emails use the display name ‘Booking Manager (via Calendly)’ and reference guest complaints, bedbug infestations, room inquiries, health inspections, and stay reviews. Lures were sent in Japanese, Danish, and Dutch, with Japanese being the most common. The emails are routed through Calendly’s email notification system and Google’s URL redirect service, a technique Microsoft calls ‘authentication laundering,’ which bypasses SPF, DKIM, and DMARC checks.

The attack chain involves a multi-hop link from Calendly through share.google and a Google redirect to a Cloudflare-fronted .cfd domain. After passing a Turnstile challenge, the victim downloads a file named photo-.zip containing a shortcut (IMG-.png.lnk or PHOTO-.png.lnk) that executes PowerShell. The PowerShell script uses BigInt arithmetic to decode a hidden download URL, retrieves a .ps1 file, and installs a legitimate Node.js v24.13.0 runtime from nodejs.org to run the JavaScript implant.

The implant, TonRAT, resolves its C2 domains via the TON blockchain API and communicates over encrypted WebSocket channels on non-standard ports (8443, 8445, 8453, 5555, 56001-56003). Some compromised hosts exhibited headless browser automation, geolocation checks, and forced shutdowns. Microsoft has not confirmed data theft, ransomware, or named victims. Full remediation requires removing both persistence paths: the RunOnce entry in ProgramData and the Node.js Run key, plus the runtime and .js files under AppDataLocalNodejs.

The campaign was previously documented by SOC Prime and ITOCHU. The operators’ end goal remains unclear, but the access is durable and cleanup is complex.