# Photo ZIP Phishing Campaign Delivering TonRAT via Node.js Abuse Targeting Hospitality Sector

> Since April 2026, an unattributed threat actor has run a two-wave phishing campaign against hotels and hospitality organizations in Europe and Asia, delivering TonRAT — a Node.js v24-based remote access trojan that resolves its C2 infrastructure dynamically via the TON blockchain API and communicates over ECDH-encrypted WebSocket sessions. Emails pass SPF, DKIM, and DMARC by relaying through Calendly infrastructure, leading victims through a Google redirect chain to photo-themed ZIP archives containing LNK droppers.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-06-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0965
- **ID:** TL-2026-0965
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since April 2026, an unattributed threat actor has conducted a two-wave phishing campaign against hotels and hospitality organizations across Europe and Asia, delivering TonRAT — a novel Node.js-based remote access trojan (RAT) that uses the TON blockchain API for dynamic command-and-control (C2) domain resolution.

The campaign employs a sophisticated delivery technique coined 'authentication laundering' by Microsoft: phishing emails are relayed through legitimate Calendly infrastructure (em1618.calendly.com), impersonating Booking Manager with high-pressure social-engineering themes including bedbug complaints, health inspections, room reviews, and threatened platform suspensions targeted at front-desk and reservations staff. Emails pass SPF, DKIM, and DMARC authentication because they are genuinely sent through Calendly. A redirect chain via share.google through www.google.com leads victims to photo-themed ZIP archives hosted behind Cloudflare Turnstile CAPTCHA gates that block automated analysis and enforce geolocation filtering.

ZIP archives contain LNK shortcut files masquerading as images via double extension (IMG-<numbers>.png.lnk in Wave 1; PHOTO-<numbers>.png.lnk in Wave 2). Executing an LNK launches obfuscated PowerShell that iterated through seven distinct obfuscation phases over the two-month campaign — from XOR bigint operations (-bxor) through subtraction, hex-to-decimal substitution, arithmetic masking, modulo/division, bigint casting, and for-loop arithmetic masking — reflecting rapid evasion adaptation against detection. PowerShell adds a Microsoft Defender exclusion for %TEMP% executables seconds before detonation.

Wave 2 (late May/June 2026) added a compile-after-delivery stage: PowerShell triggers csc.exe and cvtres.exe to dynamically compile a 3,072-byte randomized .NET DLL from user-space paths before the final payload stage. The terminal implant is TonRAT: an AES-encrypted JavaScript file executed by a legitimate Node.js v24.13.0 runtime (downloaded from nodejs.org and dropped into AppData\Local\Nodejs\). TonRAT resolves its C2 domain dynamically by querying tonapi.io (TON blockchain API), then establishes an ECDH-negotiated AES WebSocket connection to C2 servers on non-standard ports (8443, 8445, 8453, 5555, 56001-56003).

Dual registry persistence (HKCU\Software\Microsoft\Windows\CurrentVersion\Run for the Node.js runtime, HKCU\...\RunOnce for ProgramData PE payload) ensures TonRAT survives both system reboots and Defender PE-level blocks. When Defender blocked xmnrwv9l.exe, the Node.js Run key kept TonRAT operational and redeployed fresh PE payloads two days later. Post-compromise activity includes ip-api.com geolocation probing, headless browser execution with --headless --no-sandbox flags, and observed forced system shutdown via cmd /c shutdown -s -t 0 (purpose undetermined — assessed as interference, symptom hiding, or Defender-window reduction). No confirmed data exfiltration or named victims; the campaign's end objective remains undetermined.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1566 Phishing
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1553 Subvert Trust Controls
- T1016 System Network Configuration Discovery
- T1614 System Location Discovery
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1529 System Shutdown/Reboot

## Sources

- [Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access](https://www.microsoft.com/en-us/security/blog/2026/06/25/photo-zip-campaign-targeting-hospitality-industry-delivers-node-js-implant-persistent-access/)
- [Microsoft Warns of Photo-ZIP Phishing Campaign Delivering TonRAT via Node.js](https://thehackernews.com/2026/06/microsoft-warns-of-photo-zip-phishing.html)
- [Technical Analysis of Suspicious Emails Targeting the Hotel Industry (TonRAT)](https://socprime.com/active-threats/technical-analysis-of-suspicious-emails-targeting-the-hotel-industry/)
- [Analysis of Suspicious Emails Targeting the Hotel Industry](https://socprime.com/active-threats/analysis-of-suspicious-emails-targeting-the-hotel-industry/)
- [Hospitality Sector Hit by Phishing Campaign Using Fake Guest Complaint Emails](https://securityaffairs.com/194349/uncategorized/hospitality-sector-hit-by-phishing-campaign-using-fake-guest-complaint-emails.html)
- [Hotel Phishing Attack Uses Calendly to Bypass Email Authentication Filters](https://www.techtimes.com/articles/319150/20260626/hotel-phishing-attack-uses-calendly-bypass-email-authentication-filters.htm)
- [TON Blockchain API (tonapi.io) — used by TonRAT for dynamic C2 domain resolution](https://tonapi.io/)
- [Node.js v24.13.0 — legitimate runtime abused as TonRAT execution host](https://nodejs.org/en/blog/release/v24.13.0)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0965