A Node.js implant phishing campaign is targeting hotels across Europe and Asia with photo-themed ZIP archives delivered through booking- and complaint-themed phishing emails. The ZIP file contains a disguised Windows shortcut that launches PowerShell, installs a local Node.js runtime, and executes the TonRAT implant.
Microsoft has not attributed the campaign to a known threat actor, and its ultimate objective remains unconfirmed. However, the observed persistence mechanisms and command-and-control activity suggest an effort to establish long-term access to targeted systems.
Hospitality Phishing Campaign Delivers the TonRAT Node.js Implant
Hotels routinely receive guest photographs, reservation requests, complaint attachments, and booking-related communications, making image-based phishing lures particularly convincing. Threat actors exploit these everyday workflows to deliver malware while blending into legitimate business activity. A recently disclosed Node.js implant phishing campaign illustrates this approach. Since April 2026, organizations across the hospitality sector in Europe and Asia have been targeted with phishing emails impersonating booking-related communications.
Instead of attaching malware directly, the emails route recipients through a chain of trusted services before delivering photo-themed ZIP archives containing malicious shortcut files disguised as images.
The campaign stands out for its abuse of legitimate infrastructure, its multi-stage execution chain, and its use of a locally deployed Node.js runtime to execute the JavaScript-based TonRAT implant. Together, these techniques appear intended to reduce suspicion while supporting persistent access on compromised endpoints.
The activity has not been publicly attributed to a known threat actor, and the operators’ ultimate objective remains under investigation.
How the Photo ZIP Phishing Campaign Delivers the TonRAT Node.js Implant
Microsoft observed a multi-stage attack chain that abused trusted services before introducing malicious components onto the victim’s device.
The campaign begins with phishing emails using display names such as “Booking Manager (via Calendly)” and hospitality-themed subjects referencing guest complaints, room inquiries, health inspections, bedbug reports, or stay reviews.
Instead of directing victims to a malicious website, the attackers route them through Calendly notifications and Google’s URL redirection service before leading them to Cloudflare-fronted .cfd domains. Microsoft refers to this technique as authentication laundering, where trusted services are abused to make phishing emails appear more credible and, in the direct Calendly delivery path, pass standard email authentication checks.
Victims who follow the links download a ZIP archive named in the format photo-.zip. The archive contains a Windows shortcut (.LNK) file disguised as a PNG image. Although it appears to be an ordinary photograph, opening the shortcut triggers the malware execution chain instead of displaying an image.
The shortcut launches an obfuscated PowerShell command that decodes a hidden download URL and retrieves an additional PowerShell script. It then installs a legitimate Node.js runtime within the user’s profile rather than requiring a system-wide installation. The downloaded runtime is used to execute a JavaScript implant tracked as TonRAT.
Once active, TonRAT resolves its command-and-control infrastructure through the TON blockchain API before establishing encrypted WebSocket communications over non-standard ports. The investigation also observed headless browser execution, geolocation checks, forced shutdown commands, and persistence through multiple Windows Registry entries. Together, these behaviors indicate an effort to establish long-term endpoint access.
What Microsoft Confirmed About the TonRAT Phishing Campaign
The investigation also confirmed the use of legitimate services, including Calendly’s email notification infrastructure and Google’s URL redirect functionality, as part of the delivery process. In addition, the malware uses dual persistence mechanisms that can survive incomplete remediation if only one execution path is removed.
However, several aspects of the campaign remain unresolved.
The operation has not been attributed to a known threat actor, and the attackers’ ultimate objective has not been publicly confirmed. Although post-compromise activity included encrypted command-and-control communications, endpoint persistence, headless browser automation, portable executable compilation, and forced shutdown commands, there is no public evidence that the campaign resulted in credential theft, data exfiltration, ransomware deployment, or lateral movement within victim environments.
These unknowns reinforce the need for organizations to focus on detecting suspicious endpoint behaviors and investigating unusual process activity rather than assuming a specific end goal based on the malware’s capabilities alone.
Why the TonRAT Hotel Phishing Campaign Matters for Enterprise Security
Although this campaign specifically targets hotels and hospitality organizations, its underlying techniques can affect any enterprise that relies on email-driven business workflows.
Front-desk teams, reservation staff, customer support representatives, and finance personnel routinely receive attachments, booking confirmations, customer complaints, and image files from external parties. By disguising malicious shortcuts as photographs and routing victims through trusted services such as Calendly and Google redirects, attackers increase the likelihood that users will trust the emails.
The campaign also demonstrates how attackers combine familiar Windows administration tools with legitimate runtimes to complicate detection. Instead of deploying a traditional executable, the attack chain uses PowerShell to retrieve additional components before installing a local Node.js runtime that executes the JavaScript-based TonRAT implant.
Because the infection unfolds in multiple stages, manual investigations become more challenging. Security teams must correlate phishing emails, downloaded archives, scripting activity, and persistence mechanisms instead of analyzing a single malicious executable.
For enterprise security teams, the campaign reinforces several defensive priorities:
Train employees to verify unexpected emails containing attachments, customer complaints, or booking requests.
Restrict unnecessary script execution where operationally feasible.
Investigate unusual process chains involving Windows shortcuts, PowerShell, and scripting runtimes.
Maintain visibility into endpoint persistence mechanisms and outbound network activity.
Ensure endpoints remain compliant with organizational security policies.
Rather than relying solely on email filtering, organizations should adopt layered endpoint controls that help identify suspicious activity even after a user interacts with a phishing message.
EDR Explained: A Complete Guide to Modern Endpoint Security
Learn how EDR helps detect, investigate, and respond to threats on enterprise endpoints.
How Hexnode Can Help Reduce Phishing Risk
Endpoint management alone cannot eliminate phishing risk. However, organizations can use Hexnode’s unified endpoint management and endpoint detection capabilities to strengthen their security posture and support incident response.
Enforce Endpoint Security Policies with Hexnode UEM
Hexnode UEM helps administrators enforce security policies across managed Windows devices, including restrictions, application controls, and update management.
With Hexnode UEM, organizations can:
Enforce device compliance policies across managed endpoints.
Deploy operating system and application updates to reduce exposure to known vulnerabilities.
Manage approved applications while restricting unauthorized software through application management policies.
Configure device restrictions that align with organizational security requirements.
Remotely perform supported management actions on affected devices.
Together, these capabilities support consistent endpoint policy enforcement, particularly for shared front-desk systems and other business-critical devices.
Investigate Suspicious Endpoint Activity with Hexnode XDR
If suspicious endpoint activity is detected, Hexnode XDR can help security teams investigate activity and support endpoint-focused response.
Security teams can use Hexnode XDR to:
Investigate suspicious endpoint activity using Hexnode XDR’s threat hunting and endpoint query capabilities.
Review historical endpoint events to understand how activity unfolded.
Execute endpoint queries to collect relevant endpoint information.
Isolate affected devices from the network to help contain potential threats.
Terminate malicious processes when appropriate as part of incident response.
These capabilities can help analysts investigate suspicious endpoint activity and support endpoint-focused containment after suspicious activity has been identified.
Featured resource
Why XDR Is Stronger With UEM
Learn how combining UEM with XDR improves endpoint visibility, investigation, and response against modern threats.
Although this campaign does not publicly confirm credential theft, protecting enterprise identities remains an important part of a layered security strategy.
Basic conditional access based on device compliance
Together, these controls help organizations ensure that only compliant, managed devices can access business resources.
Key Takeaways from the TonRAT Node.js Implant Campaign
The TonRAT campaign demonstrates how attackers continue to refine phishing operations by combining convincing social engineering with trusted online services and multi-stage malware delivery. Rather than relying on a single malicious executable, the campaign chains together Windows shortcuts, PowerShell, a legitimate Node.js runtime, and blockchain-assisted command-and-control techniques to establish persistent endpoint access.
While Microsoft’s investigation has confirmed the infection chain and the malware involved, attribution and the attackers’ ultimate objectives remain unknown. Organizations should therefore focus on observable behaviors, including suspicious script execution, unusual process relationships, and unauthorized persistence, rather than assuming a specific post-compromise outcome.
A layered security strategy that combines user awareness, endpoint policy enforcement, device compliance, and endpoint investigation capabilities can help organizations reduce exposure to sophisticated phishing campaigns and respond more effectively when suspicious activity is identified.
Stay Ahead of Emerging Cyber Threats
From phishing campaigns to emerging malware, get expert analysis, security news, and endpoint management insights to help protect your organization.
I write at the intersection of technology, process, and people, focusing on explaining complex products with clarity. I break down tools, systems, and workflows without any noise, jargon, or the hype.
