Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant
Since April 2026, hotels and other hospitality establishments around Europe and Asia have been the target of an ongoing phishing campaign that uses photo-themed ZIP files to insert a Node.js implant and compromise front desk computers, according to Microsoft.
The operators' ultimate objective is still unknown, and the company has not linked the action to a recognized threat actor.
The attraction is based on how hotels operate. Phishing emails with the display name "Booking Manager (via Calendly)" mention health inspections, room questions, bedbug infestations, guest complaints, and stay reviews.
Japanese lures were the most prevalent, followed by Danish and Dutch lures. The lack of a recipient or property name in the subject line indicates high-volume, list-driven transmission as...