Microsoft Warns of Hotel Phishing Campaign Dropping Node.js TonRAT

Microsoft has disclosed an active phishing campaign targeting hotel and hospitality organizations across Europe and Asia since April 2026, using photo-themed ZIP archives to deliver a Node.js implant known as TonRAT. The lures impersonate "Booking Manager (via Calendly)" and reference guest complaints, bedbug infestations, room inquiries, health inspections, and stay reviews — written in Japanese, Danish, and Dutch, with Japanese the most common. The operators route messages through Calendly's email notification system and Google's URL redirect service in a technique Microsoft calls "authentication laundering," since the emails pass SPF, DKIM, and DMARC checks by virtue of being sent from legitimate authorized infrastructure. A multi-hop chain then walks victims from a Calendly link through share.google and a Google redirect to a freshly registered, Cloudflare-fronted .cfd domain protected by a Turnstile challenge that doubles as anti-analysis.

Clicking through delivers a file named photo-.zip containing a shortcut disguised as an image (IMG-.png.lnk in the first wave, PHOTO-.png.lnk in the second). Opening it fires a PowerShell script that uses BigInt arithmetic to decode a hidden download URL, retrieves a .ps1 file to %TEMP%, and drops a legitimate Node.js v24.13.0 runtime from nodejs.org into user space — no system-wide installation required. The resulting JavaScript implant, tracked as TonRAT, resolves its C2 domains through the TON blockchain API before opening an encrypted WebSocket channel, a pattern that makes static blocklists less effective. Investigators can verify suspicious domain infrastructure with a WHOIS lookup to flag the recently registered .cfd hosts being abused in this campaign.

After compromise, the implant beacons to fixed IPs over non-standard ports including 8443, 8445, 8453, 5555, and 56001–56003, with some hosts also exhibiting headless browser automation (--headless --no-sandbox), ip-api.com geolocation checks, and forced shutdown via cmd /c shutdown -s -t 0. The unusual port spread makes endpoint monitoring with a port scanner useful for surfacing suspicious listeners on hotel front-desk and back-office systems. Because TonRAT fetches C2 endpoints on the fly through the TON blockchain, defenders should also run a DNS leak test on affected hosts to identify unexpected resolver traffic patterns that could indicate beaconing.

Microsoft has not attributed the activity to a known threat actor, and the operators' end goal remains unclear, with no confirmed data theft, ransomware deployment, or named victims reported. Full remediation must address both persistence paths: a RunOnce entry pointing into ProgramData and a Node.js Run key, alongside the Node.js runtime and .js files under AppData\Local\Nodejs — removing only one leaves the other alive. SOC Prime and ITOCHU had previously documented the same hotel-focused activity, suggesting a sustained and evolving operation. Reception, reservations, and front-office systems remain the highest-priority assets for forensic review and hardening.