As cited
Copy frozen at (site build).
threat intel
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
Microsoft Threat Intelligence has identified an active campaign targeting hospitality industry organizations in Europe and Asia since April 2026, delivering a Node.js-based implant through photo-themed ZIP archives containing fake image shortcuts. The attack chain uses obfuscated PowerShell, dual registry persistence, and command-and-control communications over non-standard ports, with phishing emails leveraging legitimate services like Calendly and Google to bypass email authentication. The campaign has evolved through two waves with increasing sophistication, including new obfuscation techniques and expanded infrastructure, though the ultimate objective remains unclear.
Why it matters: Hospitality organizations should assess whether their environments have been targeted, as persistent implants and active command-and-control communications indicate preparation for additional malicious activity.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
Microsoft Threat Intelligence has identified an active campaign targeting hospitality industry organizations in Europe and Asia since April 2026, delivering a Node.js-based implant through photo-themed ZIP archives containing fake image shortcuts. The attack chain uses obfuscated PowerShell, dual registry persistence, and command-and-control communications over non-standard ports, with phishing emails leveraging legitimate services like Calendly and Google to bypass email authentication. The campaign has evolved through two waves with increasing sophistication, including new obfuscation techniques and expanded infrastructure, though the ultimate objective remains unclear.
Why it matters: Hospitality organizations should assess whether their environments have been targeted, as persistent implants and active command-and-control communications indicate preparation for additional malicious activity.
- Source published
- First seen by Cybersecurity Tracker