Loading story…
Microsoft reported an active phishing campaign targeting hotel and hospitality organizations across Europe and Asia, using booking-, complaint-, and photo-themed emails to pressure recipients into opening malicious ZIP archives. The messages were routed through trusted services including Calendly and Google redirects, and in later activity used Cloudflare-fronted .cfd domains to evade detection. The ZIP files contained fake PNG shortcut (.LNK) files that launched obfuscated PowerShell, then installed a Node.js-based implant Microsoft tracks as TonRAT; Microsoft said the campaign has been active since April and evolved across multiple waves while keeping the same core infrastructure and tradecraft.
On compromised systems, the attackers established persistence through HKCU\Run and HKCU\RunOnce, added Microsoft Defender process exclusions, and staged payloads in Temp and ProgramData, with some later samples dynamically compiling .NET DLLs via csc.exe and cvtres.exe. TonRAT communicated over encrypted WebSockets and used the TON blockchain API for command-and-control domain resolution, while Microsoft also observed beaconing on non-standard ports such as 56001 and 56002, browser automation, geolocation lookups through ip-api.com, and forced shutdown commands. Microsoft has not attributed the activity to a known threat actor or confirmed follow-on ransomware or data theft, but said the operator is investing in obfuscation, persistence, and delivery evasion to maintain access for later actions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On June 29, 2026, Trend Micro published analysis of a phishing campaign targeting Japanese accommodation facilities that are Booking.com partners in May and June 2026. The report described the TONResolver RAT, including its use of the TON blockchain via TonAPI to resolve rotating C2 infrastructure and its likely follow-on credential theft activity.
On June 25, 2026, Microsoft Threat Intelligence published technical details on the Photo ZIP campaign, including its delivery chain, persistence mechanisms, and post-compromise behavior. Microsoft said it had not attributed the activity to a known threat actor.
Microsoft observed the intrusion set evolve from Wave 1 to Wave 2 while retaining core infrastructure and behaviors. Changes included PHOTO-prefixed LNK filenames, dynamic .NET DLL compilation via csc.exe and cvtres.exe, and phishing domains fronted by Cloudflare using .cfd domains.
Microsoft said an active multi-stage intrusion campaign has targeted hotel and hospitality organizations in Europe and Asia since April 2026. The campaign used phishing emails routed through Calendly and Google redirects to deliver photo-themed ZIP archives containing malicious LNK files that launched PowerShell and installed the Node.js-based TonRAT implant.
TrendAI Research said the phishing campaign against Booking.com partner accommodations primarily targeted Japan but also hit hospitality organizations in Austria, Australia, France, Germany, Indonesia, Italy, the Netherlands, Russia, South Korea, Turkey, the UK, and the US. This expanded the known victim scope of the TONResolver campaign beyond Japanese hotels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecybersecuritynews.com
Open sourceinfosecurity-magazine.com
Open sourcecommunity.gurucul.com
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourcesocprime.com
Open sourceblog.itochuci.co.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hospitality organizations in Europe and Asia are being targeted with booking- and complaint-themed phishing emails carrying ZIP archives that contain malicious Windows shortcut (`.LNK`) files disguised as images or reservation documents. Researchers said the lures have referenced customer complaints, bed bug incidents, health alerts, and booking inquiries, and in some cases abused Calendly infrastructure and Google redirects to bypass email authentication controls. When opened, the shortcut launches hidden PowerShell to reconstruct or fetch the next-stage payload, install a legitimate Node.js runtime if needed, and execute an obfuscated JavaScript backdoor; some observed variants also dynamically compiled a .NET DLL via `csc.exe` and `cvtres.exe` before starting the implant. The malware establishes persistence through Windows Registry Run keys, with Microsoft also observing dual persistence via `HKCU\Run` and `HKCU\RunOnce`, and attempts to weaken defenses by adding Microsoft Defender exclusions. Investigators reported command-and-control infrastructure hidden behind Cloudflare, use of rotating `.cfd` domains, and in newer samples an EtherHiding-style technique that queries the TON blockchain through TONAPI to obtain current C2 addresses before communicating over encrypted WebSocket channels using `ECDH`/`HKDF`/`AES`. Post-compromise behavior included beaconing, headless browser automation, geolocation lookups, payload download and execution, and forced system shutdowns; LevelBlue linked more than 400 related LNK samples through a shared `MachineID`, indicating an active and operationally mature campaign.
Jul 17, 2026
TA558, a financially motivated threat actor active since 2018, has persistently targeted hospitality, hotel, and travel organizations—primarily in Latin America—using Portuguese- and Spanish-language reservation and booking lures. Researchers linked the actor to repeated campaign markers such as the string **"CDT"**, fake travel and hotel branding, and attacker-controlled or compromised hospitality infrastructure. Proofpoint reported that TA558 expanded activity and shifted delivery techniques from macro-enabled Office files to URLs and container attachments such as `RAR` and `ISO`, while continuing to distribute a broad set of remote access trojans including **Loda RAT**, **Revenge RAT**, **AsyncRAT**, **njRAT**, **Ozone RAT**, and **Vjw0rm**. Multiple investigations show the campaigns using multi-stage infection chains to gain remote access and steal data. Cisco Talos documented **Loda RAT** delivery through phishing documents exploiting `CVE-2017-11882`, with capabilities including keylogging, screenshots, audio capture, FileZilla credential theft, and WMI-based antivirus enumeration. Uptycs tied a Brazilian hotel-themed lure, **"Rooming List Reservas para 3 Familias.docx,"** to **Revenge RAT** delivered via remote template injection and staged PowerShell and VBScript, while Elastic observed a related booking-themed chain using a fake **"Card & Booking Details.docx"** document to deploy **XWORM** and **Agent Tesla**, disable defenses, create persistence, and exfiltrate data through a Discord webhook. The activity indicates sustained credential theft, reconnaissance, follow-on malware delivery, and potential financial fraud against both travel-sector organizations and their customers.
Aug 15, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026