Hotels Phished With Fake Guest Complaints and Hidden Malware

Two research teams, one at Microsoft and one at Trend Micro, have independently spotted phishing campaigns aimed at hotels and other hospitality businesses across Europe, Asia, and Japan. The lures are exactly the kind of thing a reservations inbox sees constantly. A guest complaint. A bedbug report. A health inspection query. A reservation problem, with photos attached as proof.

The photos arrive as a zip file. Inside, instead of images, are Windows shortcut files dressed up to look like JPEGs. Opening one quietly kicks off an obfuscated PowerShell chain in the background. In Microsoft's version of the campaign, that ends with a Node.js implant burrowing into the registry and phoning home over encrypted channels. In Trend Micro's version, it drops a JavaScript remote access tool called TONResolver, which then helps itself to credentials and pulls down more payloads.

The part worth paying attention to

The clever bit is how the attackers stay reachable. TONResolver looks up its current command-and-control server by reading a smart contract on the TON blockchain. If a server gets seized, the attackers just update the contract, and every infected machine quietly reconnects to the new address. There is no domain to sinkhole. No host to pull offline. Denis Calderone of Suzu Labs reckons the technique is shifting from novel to mainstream, having also turned up in the recent Trivy supply chain attack.

Notably, neither campaign is interested in a quick ransomware payday. Both are playing the long game, sitting on systems to harvest credentials, move sideways, and decide later what to do with the access they have built. That patience is what makes this kind of activity hard to spot and harder to undo by the time anyone notices.

Authentication laundering

The phishing emails route through trusted services like Calendly and Google's URL redirector so the initial click looks clean and slips past authentication checks. Microsoft has taken to calling this trick authentication laundering. The link technically came from a legitimate domain, so the email lands, the click lands, and the user gets to the bad place without anything obvious tripping a filter.

What actually helps

A couple of things stand out as practical.

• Front-desk and reservation terminals have no business running Node.js. If node.exe spawns on one, that is worth chasing down immediately.
• Zip files containing shortcut files masquerading as JPEGs should never reach a user. That is a content-filtering problem with a known answer.
• Staff who spend their day opening attachments from strangers deserve a fighting chance to recognise when something is off. The lure here is built precisely around the work they were hired to do, which means the only person who can sense the difference is a human who has seen this pattern before.

The campaigns are quiet by design. They want time, not headlines. That is exactly why they are worth talking about now, before the bill comes due months from now in the form of credentials sold, accounts hijacked, and someone wondering how it all started with a complaint about a bedbug.