Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources CYBERATTACKS & DATA BREACHES ENDPOINT SECURITY REMOTE WORKFORCE THREAT INTELLIGENCE NEWS Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa and the Asia Pacific Phishers Gain Persistence at EU, Asia Hospitality Orgs Separate but similar campaigns described by Microsoft and Trend Micro use malicious zip files to spread malware via social engineering and obsfucation, including blockchain abuse. Elizabeth Montalbano,Contributing Writer June 30, 2026 5 Min Read SOURCE: HENK VRIESELAAR VIA ALAMY STOCK PHOTO Attackers have been targeting hotels and other hospitality organizations with a phishing campaign that uses malicious zip files purporting to include guest photos, with the aim of installing malware to achieve long-term access to compromised systems. Both researchers at Microsoft and Trend Micro have observed the malicious activity, though they did not confirm if it was connected, according to separate reports published recently. Neither company immediately responded to a request for comment by Dark Reading about a potential link between the activities they described. Attackers in both campaigns use similar social engineering tactics to target the hospitality sector by impersonating guests who have complaints or requests, and then ultimately installing malware to gain a foothold on systems. They are both also relying on operational workflows familiar in a hospitality environment, where front-desk staff and reservation teams field inquiries from guests, the researchers said. And both sets of activity exploit trusted services to lend legitimacy to phishing emails, and ultimately deliver malware through zip archives containing Windows shortcut files disguised as images. This technique in particular has become increasingly popular among phishing attackers as Microsoft has restricted macro-based malware delivery. Related:Chinese, N. Korean Threat Groups Build on Asia-Pacific Success Perhaps most notably, rather than deploy ransomware or reap some immediate financial reward, as many phishing attacks do, both reports also describe the operators looking to establish reliable remote access to compromised systems. This is likely so they can return later to steal credentials, move laterally, or deploy additional payloads, the researchers noted. A Tale of Two Cyber Campaigns Microsoft has been tracking the intrusion campaign targeting hotels and other hospitality organizations across Europe and Asia, activity that the researchers said began in at least April. Trend Micro, meanwhile, has followed similar activity that occurred in May against Booking.com partner companies, specifically in Japan. LOADING... According to Microsoft's account, attackers sent phishing emails with themes such as guest complaints, bedbug reports, health inspections, and reservation issues. The messages often abused legitimate services, including Calendly's email notification system and Google's URL redirection service, "to bypass conventional authentication checks through a technique we describe as authentication laundering," according to the post. "By routing phishing messages through a trusted service’s sending infrastructure, the threat actor can make malicious messages appear similar to legitimate notifications to email authentication defenses," the Microsoft researchers wrote. Related:Pakistan Spies on Afghan Finance Ministry With Xeno RAT Victims who click embedded links download zip archives containing photo-themed LNK files. Opening the shortcut triggers an obfuscated PowerShell infection chain that ultimately deploys a persistent Node.js implant — a legitimate runtime for executing JavaScript outside of a browser — to create multiple registry-based persistence mechanisms and establish encrypted communications with attacker-controlled infrastructure. Blockchain Abused as Dead Drop Resolver Trend Micro documented a parallel campaign discovered in late May targeting Japanese accommodation providers that are partners of Booking.com. The phishing emails impersonated guest stay review requests and customer complaints, encouraging recipients to download zip archives containing malicious LNK files masquerading as photographs — a similar infection chain to the one Microsoft observed. However, Trend Micro's campaign differs in the malware it delivers. Though Node.js is used for obfuscation in the campaign, the ultimate payload is TONResolver, a JavaScript-based remote access Trojan (RAT). The malware gains initial access and then can both receive and execute further attacker commands, according to Trend Micro. In fact, the researchers observed evidence suggesting subsequent credential theft and additional compromise after the initial infection. Related:Tropical Blend: Cyber & Politics Ramp Up Across Latin America Moreover, the campaign's use of TONResolver is notable for its command-and-control (C2) architecture, which retrieves its current destination from a smart contract on The Open Network (TON) blockchain, and abusing TON as a dead-drop resolver. This technique allows attackers to hide C2 server addresses inside legitimate Web services using obfuscated or encoded content to evade detection. This technique is starting to gain adoption among attackers to make their C2 architecture more resilient against takedowns and law enforcement, Denis Calderone, principal and chief technology officer at Suzu Labs, tells Dark Reading. "If the C2 server gets taken down, the attacker just updates the domain inside the smart contract and every infected machine reconnects automatically," he says. "There's no server to seize and no domain to sinkhole. Traditional takedown playbooks don't work against this." Given that this technique also was recently seen in the Trivy supply chain attack, "It does seem that the attackers are learning from each other, and blockchain C2 is moving from novel to adopted," Calderone adds. Hospitality Sector Under Persistent Attack The hospitality sector is often the target of phishing attacks that not only aim to take advantage of targeted organizations themselves but also their sizable customer base. The attacks described by Microsoft and Trend Micro demonstrate yet another way cybercriminals aim to conduct malicious activity by compromising these systems for their own gain, in this case via long-term access that can be abused for malicious activity. Both Microsoft and Trend included a list of indicators of compromise and recommendations to defenders in their respective reports. Microsoft advised that organizations treat photo-themed zip archives and fake image shortcuts as high-risk; harden and monitor PowerShell execution; monitor for unexpected .NET compilation; and investigate Node.js execution from user-space paths, among other mitigations. Based on the activity its researchers observed, Trend Micro recommended that defenders deploy a proxy gateway on Internet-facing endpoints and perform connection filtering to protect against specific dead-drop resolver abuse. "Normally, the need for business environments to access blockchain platforms is considered limited," the researchers wrote. "If such communication is unnecessary, pre-emptively implementing connectivity restrictions can sever the attack chain at an intermediate stage." For the hospitality sector in general, Suzu Lab's Calderone advises security administrators to "trust little," especially when it comes to how they secure front-desk workstations. "Restrict PowerShell and Node.js execution on front-desk and reservation systems at a minimum," he says. "These workstations have no legitimate reason to run Node.js. If you see node.exe spawning on a reservations terminal, that's your indicator." Don't miss the latest Dark Reading Confidential podcast, Do CISOs Need a Code of Ethics? Kickbacks, no-show jobs, "dirty" VCs, and shelf ware — industry expert Robert "RSnake" Hansen explains why he thinks it's time for a CISO code of ethics. It could ensure cybersecurity bosses aren't engaged in self-dealing that could risk enterprise, and even national, security. Listen now! Read more about: Europe About the Author Elizabeth Montalbano Contributing Writer Elizabeth Montalbano is freelance writer, editor, and journalist with 30 years of professional experience and a master's degree from Arizona State University. Her areas of expertise include enterprise technology, cybersecurity, business, and culture. During her long career, Elizabeth has lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City. She specializes in news coverage and analysis, using her years of experience to look at the current state of cybersecurity with a critical gaze. She currently resides in a village on the southwest coast of Portugal, where in her free time she enjoys surfing, hiking with her dogs, growing plants, and playing and performing as a singer and musician. Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports The State of Cloud Security: The Latest Challenges The total economic impact™ of Snyk How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy Access More Research Webinars Practical Zero Trust Implementation on a Budget in the Age of Mythos Building a Risk Based Vulnerability Management Program Threat Hunting That Gets Big Results Despite Small Budgets Say Yes to AI: Securing Innovation Without Compromise Zero Trust Identity: Beyond Traditional Authentication More Webinars You May Also Like CYBERATTACKS & DATA BREACHES Critical Fortinet Fl