{"id":524372,"date":"2026-06-29T16:04:08","date_gmt":"2026-06-29T16:04:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/524372\/"},"modified":"2026-06-29T16:04:08","modified_gmt":"2026-06-29T16:04:08","slug":"photo-themed-phishing-campaign-targets-european-and-asian-hotels-with-node-js-implant-brief","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/524372\/","title":{"rendered":"Photo-themed phishing campaign targets European and Asian hotels with Node.js implant | brief"},"content":{"rendered":"<p>A sophisticated phishing campaign has been actively targeting hotel and hospitality organizations across Europe and Asia since April 2026, according to Microsoft. The attackers are using photo-themed ZIP files to deliver a Node.js implant, aiming to compromise front-desk machines. This campaign has been observed using techniques to bypass email security measures, The Hacker News reports.The campaign, which Microsoft has not attributed to a known threat actor, uses lures referencing common hotel operational issues like guest complaints, bedbug infestations, and health inspections. Emails are sent via Calendly and Google&#8217;s URL redirect service, a method termed &#8220;authentication laundering&#8221; by Microsoft, to bypass SPF, DKIM, and DMARC checks. Victims are directed through multiple redirects to a malicious .cfd domain. Upon clicking, they download a ZIP file containing a shortcut disguised as an image. Executing this shortcut triggers a PowerShell script that decodes a hidden URL, downloads a .ps1 file, and installs a legitimate Node.js runtime to execute the TonRAT implant.This implant communicates with its command and control servers using the TON blockchain API and opens an encrypted WebSocket channel. While the attackers&#8217; ultimate goal remains unclear, the persistence mechanisms involve RunOnce entries and Node.js Run keys, requiring thorough remediation on reception, reservation, and front office systems.Source: <a href=\"https:\/\/thehackernews.com\/2026\/06\/microsoft-warns-of-photo-zip-phishing.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">The Hacker News<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"A sophisticated phishing campaign has been actively targeting hotel and hospitality organizations across Europe and Asia since April&hellip;\n","protected":false},"author":2,"featured_media":524373,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":["post-524372","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/524372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=524372"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/524372\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/524373"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=524372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=524372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=524372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}