Photo ZIP Campaign Delivers TonRAT Node.js Implant to Hospitality Sector via Authentication Laundering — Threadlinqs Intelligence
As of 2026-07-16, Photo ZIP Campaign Delivers TonRAT Node.js Implant to Hospitality Sector via Authentication Laundering is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 36 indicators of compromise.
Threat ID: TL-2026-1406 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
An unattributed, multi-wave campaign (April-June 2026) targets hospitality/hotel front-desk staff across Europe and Asia with photo-themed ZIP archives containing fake image LNK shortcuts that trigger
Microsoft Defender Experts documented a two-wave campaign (Wave 1: April-May 2026; Wave 2: late May-June 2026) delivering a JavaScript/Node.js remote access implant tracked as TonRAT against hospitality-sector organizations (reception, front desk, reservations) in Europe and Asia. Victims receive high-volume, templated phishing emails (subjects themed around bedbug complaints, guest-safety warnings, and stay-review requests in Japanese, Danish, and Dutch) sent with the display name "Booking Manager (via Calendly)". Because the messages are relayed through a threat-actor-controlled Calendly account (em1618.calendly[.]com) riding on Calendly's SendGrid sending infrastructure, they pass SPF, DKIM, DMARC, and Microsoft's Composite Authentication (CompAuth) checks -- an authentication-laundering technique that abuses trusted third-party infrastructure (T1199) rather than any software vulnerability. Clicking the notification link routes the victim through a multi-hop redirect chain: calendly[.]com/url?q= -> share.google/TOKEN -> www.google.com/share_google?q= -> a Cloudflare Turnstile-gated photo-*.cfd landing page, which serves a browser-downloaded ZIP archive named photo-<digits>.zip. Inside is a fake image shortcut (IMG-<digits>.png.lnk in Wave 1, PHOTO-<digits>.png.lnk in Wave 2, both a consistent 1,989-2,079 bytes, indicating reuse of a single builder tool) that, when opened, launches heavily obfuscated PowerShell. The obfuscation evolved across seven observed phases -- from simple XOR-with-bigint, through subtraction-based decoding, hex-to-decimal conversion, arithmetic masking, modulo/division operations, randomized bigint-cast variable names, to a Wave-2 for-loop variant -- each phase designed to defeat static PowerShell signatures while recovering a staged .ps1 script written to %TEMP%. In Wave 1 the PowerShell directly downloads and launches the Node.js runtime; in Wave 2 it additionally compiles a small .NET DLL on-target via csc.exe/cvtres.exe before deploying Node.js, adding an extra evasion layer. The actor installs a legitimate, unmodified Node.js Windows binary (node-v24.13.0-win-x64, fetched from nodejs.org) into a user-writable path (%LOCALAPPDATA%\Nodejs) to avoid system dependencies, then launches it against a randomly named .js payload with the C2 domain as a command-line argument. Before this, the actor issues Add-MpPreference -ExclusionProcess to exempt Temp-staged EXEs from Defender scanning, and installer helper .tmp files run with /SL5 or /VERYSILENT silent-install flags. Persistence is dual-registry: an HKCU\...\Run entry points at the Node.js interpreter for long-term survival, while an HKCU\...\RunOnce entry points at a copy of the loader EXE relocated into a randomly-named C:\ProgramData subfolder -- and critically, the RunOnce value re-creates itself after each execution, defeating defenders who treat RunOnce entries as one-time and complicating cleanup. In one observed incident the Node.js Run-key persistence survived Defender blocking the initial ProgramData PE payload (detected as Wacatac), allowing C2 communication to resume two days later. Command-and-control uses a rotating stable of non-standard ports (8443, 8445, 8453, 5555, 56001-56003) against a primary IP (178.16.54[.]27) active across both waves plus several secondary IPs, alongside domains rotated roughly every 2-3 days across a wide range of TLDs (.info, .com, .pro, .xyz, .cloud, .icu, .sbs in Wave 1; .cfd, .click, .bond added in Wave 2 for Cloudflare fronting). Post-compromise behavior observed includes headless/no-sandbox browser automation, geolocation lookups via ip-api[.]com, and forced remote shutdown commands. Microsoft has not attributed the campaign to a known threat actor but assesses a single disciplined operator managing parallel delivery mechanisms with clear operational maturation (infrastructure expansion, evasion refinement, persistence-durability investment) across the two waves, suggesting preparation for follow-on activ
Target sectors: hospitality, hotels
Target regions: Europe, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 36 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
6 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583.001, T1583.006, T1566.002, T1199, T1656, T1204.002, T1059.001, T1059.007, T1027, T1027.004