Hotel Phishing Hides Node.js Backdoor in Photo ZIPs

Microsoft has flagged a phishing campaign that has been quietly grinding away at hotels across Europe and Asia since April. The lure is tuned for the audience: emails from "Booking Manager (via Calendly)" referencing bedbug infestations, guest complaints, health inspections and stay reviews. The kind of subject line a front-desk worker opens immediately, because ignoring it feels worse than reading it.

Lures arrive in Japanese, Danish and Dutch, with Japanese the most common. None of them name a recipient or a specific property, which points to bulk list-driven sending rather than careful targeting.

Authentication laundering

The clever bit is the delivery. The messages are routed through Calendly's own notification system and Google's URL redirect service. Because the mail genuinely originates from Calendly's infrastructure, it passes SPF, DKIM and DMARC without breaking a sweat. Microsoft calls this authentication laundering, and it is a useful phrase. The checks confirm a sender is allowed to send. They have nothing to say about whether you actually want to hear from them.

From Calendly the chain hops through share.google and a Google redirect to a freshly registered .cfd domain sitting behind Cloudflare, with a Turnstile challenge that conveniently doubles as anti-analysis. Click through and a file called photo-<numbers>.zip lands on disk.

A real Node.js running fake photos

Inside the ZIP is a Windows shortcut dressed up as an image, something like IMG-<numbers>.png.lnk. Double-clicking it fires PowerShell, which decodes a hidden URL using BigInt arithmetic and downloads the legitimate Node.js v24.13.0 runtime straight from nodejs.org into the user profile. No admin rights, no system install, just a clean copy of Node running the attacker's JavaScript.

The implant, tracked as TonRAT, resolves its command servers through the TON blockchain API before opening an encrypted WebSocket channel. Static blocklists are largely cosmetic against that. Infected hosts beacon to fixed IPs on odd ports including 8443, 8445, 8453, 5555 and 56001 to 56003. Microsoft has observed headless browser automation, ip-api.com geolocation lookups and a forced shutdown via cmd. There is no confirmed data theft, no ransomware, and no attribution to a known group. What the operators actually want is still an open question.

If you run hotel IT

Reception, reservations and front-office machines are the first places to check. Persistence sits in two places:

• A RunOnce entry pointing into ProgramData
• A Node.js Run key feeding the runtime and .js files under AppData\Local\Nodejs

Clean up one and leave the other and you still have an active implant on the box.

The wider point sits awkwardly with anyone who treats inbox authentication as a finish line. A message that passes SPF, DKIM and DMARC can still be sent by someone you would rather not hear from. The people on the front desk, taking complaints at speed under reputational pressure, are the ones being asked to spot the difference.