Hotels and hospitality organizations are being targeted by phishing campaigns that use malicious ZIP files disguised as guest photo attachments.
Researchers at Microsoft and Trend Micro observed similar activity aimed at hospitality staff, including front-desk teams, reservation departments, and accommodation providers. The attackers impersonate guests with complaints, review requests, reservation issues, or urgent support questions, then push employees to download ZIP archives containing fake image files.
Behind those “photos” are malicious Windows shortcut files designed to launch malware and establish long-term access to hotel systems.
Why the Hospitality Sector Is Being Targeted
The hospitality sector is a natural target for this kind of social engineering.
Hotel staff regularly receive messages from guests, booking platforms, and travel partners. They are expected to open attachments, review photos, respond quickly, and resolve complaints.
Attackers are abusing that workflow.
Instead of sending obvious malware, they send messages that look like normal hotel operations:
- guest complaints
- bedbug reports
- health inspection claims
- reservation issues
- stay review requests
- customer service requests
This makes the phishing emails more believable and increases the chance that staff will open the attachment.
Fake Photos, ZIP Files, and Malicious Shortcuts
Both Microsoft and Trend Micro described attacks that rely on ZIP archives containing Windows shortcut files.
The shortcut files are disguised as images, making them appear like guest photos.
When opened, the file does not display a normal image. Instead, it starts an infection chain that can run scripts and download additional malware.
This technique has become more common as attackers move away from traditional macro-based malware delivery. With Microsoft making macro abuse harder, phishing operators are increasingly using archive files, shortcut files, script chains, and trusted services to bypass defenses.
Microsoft: Node.js Implant Used for Persistent Access
Microsoft observed attacks against hotels and hospitality organizations across Europe and Asia, with activity beginning at least in April.
The phishing emails abused legitimate services such as Calendly notifications and Google URL redirection. Microsoft described this as “authentication laundering,” where attackers route malicious messages through trusted services so they appear more legitimate to email security systems.
After the victim opened the fake photo shortcut, the infection chain used obfuscated PowerShell commands and eventually deployed a persistent Node.js-based implant.
That implant created registry-based persistence and established encrypted communication with attacker-controlled infrastructure.
The goal was not immediate ransomware deployment. Instead, the attackers appeared focused on maintaining reliable access for future activity.
Trend Micro: Booking.com Partners Targeted in Japan
Trend Micro observed a similar campaign in late May targeting Japanese accommodation providers partnered with Booking.com.
The phishing emails impersonated guest review requests and customer complaints. Like the Microsoft-observed activity, the attack relied on ZIP archives containing malicious LNK files disguised as photographs.
However, the final payload was different.
Trend Micro reported that the campaign delivered TONResolver, a JavaScript-based remote access Trojan. Node.js was used for obfuscation, but the RAT provided the attacker with the ability to receive and execute further commands.
Researchers also observed signs of follow-on activity, including credential theft and additional compromise after the initial infection.
Blockchain-Based C2 Makes Takedown Harder
One of the more notable parts of the Trend Micro campaign is TONResolver’s command-and-control design.
The malware retrieves its current C2 destination from a smart contract on The Open Network, known as TON. In this setup, the blockchain acts as a dead-drop resolver.
That means the malware does not need to rely on a single hardcoded command server.
If the attacker’s C2 server is taken down, the operator can update the destination in the smart contract. Infected systems can then reconnect automatically to the new infrastructure.
This makes traditional takedown methods harder because there may be no single domain to seize or sinkhole.
Long-Term Access Is the Real Goal
A key point in both reports is that the attackers do not appear focused only on quick monetization.
Instead of immediately deploying ransomware or running obvious fraud, the campaigns are designed to establish a foothold.
That long-term access can later be used for:
- credential theft
- lateral movement
- additional malware deployment
- guest data theft
- booking platform abuse
- financial fraud
- ransomware staging
For hotels, this is especially serious because compromised reservation systems may contain guest records, payment-related data, partner portal access, and operational information.
What Defenders Should Watch For
Hospitality organizations should treat photo-themed ZIP archives as high-risk, especially when sent with urgent guest complaints or booking-related messages.
Security teams should watch for:
- ZIP archives claiming to contain guest photos
- LNK files disguised as images
- PowerShell launched from user activity
- unexpected Node.js execution on front-desk systems
- Node.js running from user-space paths
- suspicious registry persistence
- unusual outbound encrypted connections
- unexpected access to blockchain-related services
- abnormal login activity after phishing emails
A front-desk or reservations workstation usually has no legitimate reason to run Node.js or complex PowerShell scripts. That behavior should trigger investigation.
Recommended Defensive Actions
Hotels and hospitality providers should strengthen controls around front-desk and reservation systems.
Important steps include:
- block or heavily inspect ZIP attachments
- restrict Windows shortcut execution from archives
- harden PowerShell usage
- monitor for unexpected Node.js execution
- limit software execution on front-desk systems
- use application control where possible
- train staff to verify guest photo attachments
- monitor booking platform accounts for suspicious activity
- enforce strong multi-factor authentication
- restrict unnecessary blockchain platform access
- investigate unusual outbound traffic from reservation terminals
For many hospitality environments, the most practical rule is simple: front-desk systems should only run the tools needed for hotel operations.
Anything outside that baseline should be treated as suspicious.
Final Thoughts
These campaigns show how attackers are adapting phishing tactics to match real business workflows.
In hospitality, guest communication is constant. That creates an opening for attackers to disguise malware as complaints, booking issues, review requests, or guest photos.
The technical chain is also evolving. Malicious shortcuts, PowerShell, Node.js implants, JavaScript RATs, trusted-service abuse, and blockchain-based C2 all make these campaigns harder to detect and disrupt.
The lesson is clear: hospitality organizations should treat unexpected guest photo archives as a serious security risk.
One fake image can become long-term access to the business.
