Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant
Summary: Microsoft says a phishing campaign active since April 2026 has targeted hotel and hospitality organizations in Europe and Asia with photo-themed ZIP files that drop a Node.js implant on front-desk machines, using lures in Japanese, Danish, and Dutch sent through Calendly and Google redirects so the messages pass SPF, DKIM, and DMARC. The ZIP contains a .png.lnk shortcut that fires PowerShell, decodes a hidden download URL via BigInt arithmetic, and installs a legitimate Node.js v24.13.0 runtime in user space to run an implant tracked as TonRAT, which resolves command-and-control domains through the TON blockchain API and beacons to fixed IPs on non-standard ports including 8443, 8445, 8453, 5555, and 56001 to 56003.
Why it matters: Microsoft has not attributed the activity or identified the operators' goal, and no confirmed data theft or ransomware has been reported, yet the access is durable and remediation must remove both the RunOnce entry in ProgramData and the Node.js Run key plus files under AppData\Local\Nodejs, since pulling one leaves the other alive.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026