Photo ZIP Phishing Campaign Delivering TonRAT via Node.js Abuse Targeting Hospitality Sector

Photo ZIP Phishing Campaign Delivering TonRAT via Node.js (TL-2026-0965), also tracked as Photo ZIP Campaign, is a high-severity phishing campaign, first published 2026-06-28. It has no confirmed attribution, affects Microsoft Windows, maps to 20 MITRE ATT&CK techniques (T1016, T1027, T1036), and is covered by 9 detection rules and 40 indicators of compromise.

Key facts for TL-2026-0965

Threat ID
TL-2026-0965
Also known as
Photo ZIP Campaign, TonRAT Campaign, Node.js Hospitality RAT
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-06-28
Last reviewed
2026-06-28
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
hospitality, hotel, travel, booking-platform
Target regions
Europe, Asia, japan, denmark, netherlands, france, poland, Czech Republic, spain
Detection rules
9
Indicators of compromise
40

Malware and tooling in Photo ZIP Phishing Campaign Delivering TonRAT via Node.js

Malware and tooling: TonRAT, csc.exe, node-v24.13.0-win-x64

Since April 2026, an unattributed threat actor has run a two-wave phishing campaign against hotels and hospitality organizations in Europe and Asia, delivering TonRAT — a Node.js v24-based remote access trojan that resolves its C2 infrastructure dynamically via the TON blockchain API and communicates over ECDH-encrypted WebSocket sessions. Emails pass SPF, DKIM, and DMARC by relaying through Calendly infrastructure, leading victims through a Google redirect chain to photo-themed ZIP archives containing LNK droppers.

How Photo ZIP Phishing Campaign Delivering TonRAT via Node.js works

Since April 2026, an unattributed threat actor has conducted a two-wave phishing campaign against hotels and hospitality organizations across Europe and Asia, delivering TonRAT — a novel Node.js-based remote access trojan (RAT) that uses the TON blockchain API for dynamic command-and-control (C2) domain resolution.

The campaign employs a sophisticated delivery technique coined 'authentication laundering' by Microsoft: phishing emails are relayed through legitimate Calendly infrastructure (em1618.calendly.com), impersonating Booking Manager with high-pressure social-engineering themes including bedbug complaints, health inspections, room reviews, and threatened platform suspensions targeted at front-desk and reservations staff. Emails pass SPF, DKIM, and DMARC authentication because they are genuinely sent through Calendly. A redirect chain via share.google through www.google.com leads victims to photo-themed ZIP archives hosted behind Cloudflare Turnstile CAPTCHA gates that block automated analysis and enforce geolocation filtering.

ZIP archives contain LNK shortcut files masquerading as images via double extension (IMG-<numbers>.png.lnk in Wave 1; PHOTO-<numbers>.png.lnk in Wave 2). Executing an LNK launches obfuscated PowerShell that iterated through seven distinct obfuscation phases over the two-month campaign — from XOR bigint operations (-bxor) through subtraction, hex-to-decimal substitution, arithmetic masking, modulo/division, bigint casting, and for-loop arithmetic masking — reflecting rapid evasion adaptation against detection. PowerShell adds a Microsoft Defender exclusion for %TEMP% executables seconds before detonation.

Wave 2 (late May/June 2026) added a compile-after-delivery stage: PowerShell triggers csc.exe and cvtres.exe to dynamically compile a 3,072-byte randomized .NET DLL from user-space paths before the final payload stage. The terminal implant is TonRAT: an AES-encrypted JavaScript file executed by a legitimate Node.js v24.13.0 runtime (downloaded from nodejs.org and dropped into AppData\Local\Nodejs\). TonRAT resolves its C2 domain dynamically by querying tonapi.io (TON blockchain API), then establishes an ECDH-negotiated AES WebSocket connection to C2 servers on non-standard ports (8443, 8445, 8453, 5555, 56001-56003).

Dual registry persistence (HKCU\Software\Microsoft\Windows\CurrentVersion\Run for the Node.js runtime, HKCU\...\RunOnce for ProgramData PE payload) ensures TonRAT survives both system reboots and Defender PE-level blocks. When Defender blocked xmnrwv9l.exe, the Node.js Run key kept TonRAT operational and redeployed fresh PE payloads two days later. Post-compromise activity includes ip-api.com geolocation probing, headless browser execution with --headless --no-sandbox flags, and observed forced system shutdown via cmd /c shutdown -s -t 0 (purpose undetermined — assessed as interference, symptom hiding, or Defender-window reduction). No confirmed data exfiltration or named victims; the campaign's end objective remains undetermined.

MITRE ATT&CK techniques used in TL-2026-0965

Discovery

T1016 System Network Configuration Discovery; T1614 System Location Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1573 Encrypted Channel

Initial Access

T1199 Trusted Relationship; T1566 Phishing

Impact

T1529 System Shutdown/Reboot

Persistence

T1547 Boot or Logon Autostart Execution

defense-impairment

T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure

Affected products and versions in Photo ZIP Phishing Campaign Delivering TonRAT via Node.js

  • Microsoft — Windows
    Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022

Remediation for Photo ZIP Phishing Campaign Delivering TonRAT via Node.js

Immediate actions

  • Block all C2 IPs at perimeter: 178.16.54.27, 95.217.97.121, 193.202.84.32, 178.16.55.179
  • Block all .info, .cfd, .bond Wave 1/2 C2 domains via DNS sinkhole (see IOC list)
  • Block outbound connections to tonapi.io to prevent TON blockchain C2 resolution
  • Hunt for node.exe executing from AppData\Local\Nodejs\ on all endpoints
  • Audit HKCU Run and RunOnce registry keys for Node.js and ProgramData executable entries — BOTH keys must be removed simultaneously for complete remediation
  • Search email gateway for messages from em1618.calendly.com with display name 'Booking Manager'
  • Search for ZIP attachments containing .png.lnk double-extension files
  • Block file hashes: 04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1, 9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2, 97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f, c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5, b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6bea

Workarounds

  • Restrict PowerShell execution via Constrained Language Mode
  • Block LNK file execution from ZIP archives via Windows Attachment Manager or WDAC rules
  • Disable or alert on HKCU registry Run key modifications from PowerShell
  • Use DNS RPZ to block dynamic .cfd, .bond, .xyz, .click TLD patterns for photo-* domains

Longer-term hardening

  • Deploy EDR with behavioral detection for Node.js spawned from user-space paths
  • Alert on Add-MpPreference -ExclusionProcess execution from any non-administrative context
  • Monitor for csc.exe and cvtres.exe spawned from PowerShell in user-space paths
  • Implement DNS monitoring to detect tonapi.io queries from endpoints
  • Restrict execution of node.exe to approved directories via AppLocker or WDAC
  • Block outbound WebSocket connections on non-standard ports (8443, 8445, 8453, 5555, 56001-56003) for non-approved processes
  • Train hospitality front-desk staff to recognize Booking Manager / Calendly-relayed phishing lures
  • Implement email gateway rules to flag Calendly-relayed messages to hospitality accounts
  • Enable Show File Extensions to surface .png.lnk double-extension masquerading

Timeline of Photo ZIP Phishing Campaign Delivering TonRAT via Node.js

  • Wave 1 LNK file (IMG-386443483.png.lnk, SHA-256: 9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2) distributed with .info C2 domains (safedocphoto.info, prejointl.info, etc.); PowerShell Phases 1-2 obfuscation (XOR bigint -bxor, then subtraction operators) used.
  • Wave 1 phishing campaign begins targeting hospitality sector in Europe and Asia; IMG-<numbers>.png.lnk LNK files distributed in photo-themed ZIP attachments via Calendly-spoofed emails with bedbug/complaint social-engineering lures in Japanese, Danish, Dutch, and other languages.
  • PowerShell obfuscation iterates rapidly through Phases 3-5 in response to detection: Phase 3 substitutes hexadecimal (0xFF) with decimal (255) equivalents; Phase 4 uses arithmetic masking (177+78 instead of constant 255); Phase 5 replaces bit-shift operators with modulo/division (%256, /256).
  • Threat actor introduces 'authentication laundering' delivery: emails now routed through legitimate Calendly infrastructure (em1618.calendly.com) via Booking Manager impersonation, producing emails that genuinely pass SPF, DKIM, and DMARC. Redirect chain through share.google and www.google.com added. Cloudflare Turnstile CAPTCHA gate deployed on download pages to block automated analysis and enforce geolocation filtering.
  • Wave 2 campaign launches with PHOTO-<numbers>.png.lnk LNK files (SHA-256: 97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f), Cloudflare-fronted .cfd domains (photo-26254.cfd, photo-26654.cfd, etc.), .bond and .click TLDs for C2, and a new csc.exe/.NET compile-after-delivery stage generating a 3,072-byte randomized DLL. Phase 6 (bigint -as [bigint] casting) and Phase 7 (for-loop arithmetic masking) obfuscation introduced.
  • Microsoft Defender blocks xmnrwv9l.exe PE payload (SHA-256: 04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1). TonRAT implant survives via HKCU\Software\Microsoft\Windows\CurrentVersion\Run key pointing to Node.js runtime and .js implant in AppData\Local\Nodejs\; reestablishes C2 within ~2 days and redeployes fresh PE payloads (cBA8H4S5k04jAY.exe, eaa3q8BQZcnIOV.exe), demonstrating dual-persistence resilience.
  • SOC Prime and ITOCHU publish initial TonRAT technical analysis documenting the Node.js v24 runtime abuse pattern, TON blockchain API C2 resolution via tonapi.io, and WebSocket encrypted channel behavior — first public documentation of TonRAT.
  • Microsoft Security publishes comprehensive 'Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access' blog, coining the term 'authentication laundering' for Calendly + Google relay phishing, documenting both waves, all seven PowerShell obfuscation phases, IOCs, and full kill chain.
  • Wave 2 .cfd domains continue rotating every 2-3 days; threat actor maintains active infrastructure with multiple C2 IPs (178.16.54.27, 95.217.97.121, 193.202.84.32, 178.16.55.179). TON blockchain-based C2 resolution makes domain-blocking a lagging control. Campaign objective remains undetermined — no confirmed data exfiltration or ransomware stage observed.
  • The Hacker News and Security Affairs cover the Microsoft advisory, expanding public awareness of TonRAT campaign across the security community. Campaign assessed as still active as of coverage date.

Sources cited for Photo ZIP Phishing Campaign Delivering TonRAT via Node.js

Threats related to Photo ZIP Phishing Campaign Delivering TonRAT via Node.js

Detection coverage for TL-2026-0965

As of 2026-06-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0965 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-0965

8 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats