Loading story…
Hospitality organizations in Europe and Asia are being targeted with booking- and complaint-themed phishing emails carrying ZIP archives that contain malicious Windows shortcut (.LNK) files disguised as images or reservation documents. Researchers said the lures have referenced customer complaints, bed bug incidents, health alerts, and booking inquiries, and in some cases abused Calendly infrastructure and Google redirects to bypass email authentication controls. When opened, the shortcut launches hidden PowerShell to reconstruct or fetch the next-stage payload, install a legitimate Node.js runtime if needed, and execute an obfuscated JavaScript backdoor; some observed variants also dynamically compiled a .NET DLL via csc.exe and cvtres.exe before starting the implant.
The malware establishes persistence through Windows Registry Run keys, with Microsoft also observing dual persistence via HKCU\Run and HKCU\RunOnce, and attempts to weaken defenses by adding Microsoft Defender exclusions. Investigators reported command-and-control infrastructure hidden behind Cloudflare, use of rotating .cfd domains, and in newer samples an EtherHiding-style technique that queries the TON blockchain through TONAPI to obtain current C2 addresses before communicating over encrypted WebSocket channels using ECDH/HKDF/AES. Post-compromise behavior included beaconing, headless browser automation, geolocation lookups, payload download and execution, and forced system shutdowns; LevelBlue linked more than 400 related LNK samples through a shared MachineID, indicating an active and operationally mature campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that the earliest observed samples associated with the hospitality phishing campaign date back to March 2026. This pushes the known activity window earlier than previously documented public observations.
LevelBlue reported observing daily new samples and more than 400 related LNK files sharing a common MachineID, indicating the operation is ongoing and mature. Reporting also noted infrastructure protected behind Cloudflare and encrypted WebSocket communications for the backdoor.
LevelBlue described an active multi-stage campaign targeting the hospitality sector with booking-themed ZIP archives containing malicious LNK files that ultimately run a Node.js backdoor. The researchers said the malware used EtherHiding by querying the TON blockchain through TONAPI to retrieve its current C2 address instead of hardcoding it.
Microsoft reported a second wave in which PowerShell dynamically compiled a .NET DLL via csc.exe and cvtres.exe before launching a Node.js-based implant. The malware also used dual persistence through HKCU\Run and HKCU\RunOnce and added Microsoft Defender process exclusions.
In the campaign's first wave, malicious LNK files launched obfuscated PowerShell to download a script and deploy Node.js. The malware then established persistence and began post-compromise activity including C2 beaconing and other host actions.
Microsoft documented an active intrusion campaign observed since April 2026 targeting hospitality organizations in Europe and Asia with photo-themed ZIP archives containing malicious LNK files disguised as PNG images. The lures used themes such as customer complaints, bed bug infestations, and health alerts in Japanese, Danish, and Dutch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcelevelblue.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported an active phishing campaign targeting hotel and hospitality organizations across Europe and Asia, using booking-, complaint-, and photo-themed emails to pressure recipients into opening malicious ZIP archives. The messages were routed through trusted services including Calendly and Google redirects, and in later activity used Cloudflare-fronted `.cfd` domains to evade detection. The ZIP files contained fake PNG shortcut (`.LNK`) files that launched obfuscated PowerShell, then installed a Node.js-based implant Microsoft tracks as **TonRAT**; Microsoft said the campaign has been active since April and evolved across multiple waves while keeping the same core infrastructure and tradecraft. On compromised systems, the attackers established persistence through `HKCU\Run` and `HKCU\RunOnce`, added Microsoft Defender process exclusions, and staged payloads in `Temp` and `ProgramData`, with some later samples dynamically compiling .NET DLLs via `csc.exe` and `cvtres.exe`. TonRAT communicated over encrypted WebSockets and used the TON blockchain API for command-and-control domain resolution, while Microsoft also observed beaconing on non-standard ports such as `56001` and `56002`, browser automation, geolocation lookups through `ip-api.com`, and forced shutdown commands. Microsoft has not attributed the activity to a known threat actor or confirmed follow-on ransomware or data theft, but said the operator is investing in obfuscation, persistence, and delivery evasion to maintain access for later actions.
Aug 11, 2026
Suspected Russian cybercriminals have launched a sophisticated phishing campaign targeting the European hospitality industry, leveraging fake Windows Blue Screen of Death (BSOD) pages to distribute malware. The attack, tracked as "PHALT#BLYX" by Securonix researchers, begins with phishing emails impersonating popular booking platforms such as Booking.com, often using reservation cancellation lures with details in Euros to specifically target hotels, hostels, and inns in Europe. Victims are directed to high-fidelity cloned websites that mimic legitimate booking services, where they encounter fake error messages and BSOD screens designed to prompt them into executing malicious commands. The campaign employs the "ClickFix" technique, which manipulates users into manually running PowerShell or shell commands under the guise of resolving system errors. This process ultimately results in the installation of the DCRat malware, a remote access trojan capable of keylogging and other malicious activities. Technical indicators, including Russian-language debug strings and infrastructure geolocated to Russia, suggest a strong Russian connection. The campaign demonstrates a blend of social engineering and technical deception, exploiting human problem-solving instincts to compromise systems within the hospitality sector during its busiest season.
Jun 29, 2026
Multiple reports describe **phishing-led malware delivery** that abuses trusted services and “living off the land” execution paths to evade controls and deploy remote access tooling. Cloudflare-tracked activity shows attackers using **Vercel-hosted** pages to lend legitimacy to malicious links and bypass email/security filtering, with lures themed around invoices, payments, shipping, and document portals; the infrastructure includes **Telegram-based filtering** and browser fingerprinting/conditional delivery to hinder researchers and sandboxes before serving payloads that install a **remote access tool (RAT)**. A separate campaign (tracked as **PHALT#BLYX**) targets hospitality staff with Booking[.]com-style reservation emails and uses a **fake browser error + fake BSOD** to coerce victims into running the **ClickFix** technique (Win+R paste/execute), launching PowerShell that pulls malicious project files and executes them via **`MSBuild.exe`** to deliver **DCRat**, consistent with **LOLBins**-based evasion; researchers noted Russian-language artifacts in the malware. Broader weekly/newsletter roundups also highlight the same risk theme—attackers increasingly blend social engineering with trusted infrastructure and tools—while mixing in unrelated items (e.g., firewall CVEs, general malware research links) that are not part of a single, specific incident narrative.
Jun 29, 2026