Photo ZIP Campaign Delivers TonRAT Node.js Implant to Hospitality Sector via Authentication Laundering
Photo ZIP Campaign Delivers TonRAT Node.js Implant to (TL-2026-1406), also tracked as Photo ZIP Campaign, is a high-severity malware campaign, first published 2026-07-16. It has no confirmed attribution, affects N/A Hospitality sector Windows endpoints, maps to 15 MITRE ATT&CK techniques (T1016, T1027, T1027.004), and is covered by 9 detection rules and 36 indicators of compromise.
Key facts for TL-2026-1406
- Threat ID
- TL-2026-1406
- Also known as
- Photo ZIP Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- hospitality, hotels
- Target regions
- Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 36
Malware and tooling in Photo ZIP Campaign Delivers TonRAT Node.js Implant to
Malware and tooling: TonRAT, node-v24.13.0-win-x64
An unattributed, multi-wave campaign (April-June 2026) targets hospitality/hotel front-desk staff across Europe and Asia with photo-themed ZIP archives containing fake image LNK shortcuts that trigger a seven-phase-obfuscated PowerShell decoder chain, ultimately deploying a Node.js-based implant (TonRAT) for persistent, dual-registry C2 access. The actor abuses Calendly notification infrastructure and Google URL redirects to launder phishing emails through legitimate SendGrid-backed infrastructure so they pass SPF/DKIM/DMARC/CompAuth checks.
How Photo ZIP Campaign Delivers TonRAT Node.js Implant to works
Microsoft Defender Experts documented a two-wave campaign (Wave 1: April-May 2026; Wave 2: late May-June 2026) delivering a JavaScript/Node.js remote access implant tracked as TonRAT against hospitality-sector organizations (reception, front desk, reservations) in Europe and Asia. Victims receive high-volume, templated phishing emails (subjects themed around bedbug complaints, guest-safety warnings, and stay-review requests in Japanese, Danish, and Dutch) sent with the display name "Booking Manager (via Calendly)". Because the messages are relayed through a threat-actor-controlled Calendly account (em1618.calendly[.]com) riding on Calendly's SendGrid sending infrastructure, they pass SPF, DKIM, DMARC, and Microsoft's Composite Authentication (CompAuth) checks -- an authentication-laundering technique that abuses trusted third-party infrastructure (T1199) rather than any software vulnerability. Clicking the notification link routes the victim through a multi-hop redirect chain: calendly[.]com/url?q= -> share.google/TOKEN -> www.google.com/share_google?q= -> a Cloudflare Turnstile-gated photo-*.cfd landing page, which serves a browser-downloaded ZIP archive named photo-<digits>.zip. Inside is a fake image shortcut (IMG-<digits>.png.lnk in Wave 1, PHOTO-<digits>.png.lnk in Wave 2, both a consistent 1,989-2,079 bytes, indicating reuse of a single builder tool) that, when opened, launches heavily obfuscated PowerShell. The obfuscation evolved across seven observed phases -- from simple XOR-with-bigint, through subtraction-based decoding, hex-to-decimal conversion, arithmetic masking, modulo/division operations, randomized bigint-cast variable names, to a Wave-2 for-loop variant -- each phase designed to defeat static PowerShell signatures while recovering a staged .ps1 script written to %TEMP%. In Wave 1 the PowerShell directly downloads and launches the Node.js runtime; in Wave 2 it additionally compiles a small .NET DLL on-target via csc.exe/cvtres.exe before deploying Node.js, adding an extra evasion layer. The actor installs a legitimate, unmodified Node.js Windows binary (node-v24.13.0-win-x64, fetched from nodejs.org) into a user-writable path (%LOCALAPPDATA%\Nodejs) to avoid system dependencies, then launches it against a randomly named .js payload with the C2 domain as a command-line argument. Before this, the actor issues Add-MpPreference -ExclusionProcess to exempt Temp-staged EXEs from Defender scanning, and installer helper .tmp files run with /SL5 or /VERYSILENT silent-install flags. Persistence is dual-registry: an HKCU\...\Run entry points at the Node.js interpreter for long-term survival, while an HKCU\...\RunOnce entry points at a copy of the loader EXE relocated into a randomly-named C:\ProgramData subfolder -- and critically, the RunOnce value re-creates itself after each execution, defeating defenders who treat RunOnce entries as one-time and complicating cleanup. In one observed incident the Node.js Run-key persistence survived Defender blocking the initial ProgramData PE payload (detected as Wacatac), allowing C2 communication to resume two days later. Command-and-control uses a rotating stable of non-standard ports (8443, 8445, 8453, 5555, 56001-56003) against a primary IP (178.16.54[.]27) active across both waves plus several secondary IPs, alongside domains rotated roughly every 2-3 days across a wide range of TLDs (.info, .com, .pro, .xyz, .cloud, .icu, .sbs in Wave 1; .cfd, .click, .bond added in Wave 2 for Cloudflare fronting). Post-compromise behavior observed includes headless/no-sandbox browser automation, geolocation lookups via ip-api[.]com, and forced remote shutdown commands. Microsoft has not attributed the campaign to a known threat actor but assesses a single disciplined operator managing parallel delivery mechanisms with clear operational maturation (infrastructure expansion, evasion refinement, persistence-durability investment) across the two waves, suggesting preparation for follow-on activity beyond what has been observed to date. No CVE or software vulnerability is involved; the entire chain relies on social engineering and abuse of legitimate services (Calendly, Google redirects, Cloudflare, nodejs.org).
MITRE ATT&CK techniques used in TL-2026-1406
Discovery
T1016 System Network Configuration Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1027.004 Compile After Delivery; T1036 Masquerading
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Initial Access
T1199 Trusted Relationship; T1566.002 Spearphishing Link
Persistence
T1547.001 Registry Run Keys / Startup Folder
Command and Control
Resource Development
T1583.001 Domains; T1583.006 Web Services
stealth
defense-impairment
Affected products and versions in Photo ZIP Campaign Delivers TonRAT Node.js Implant to
- N/A — Hospitality sector Windows endpoints (reception/front-desk/reservations workstations)
Vulnerable versions: N/A - social engineering / infrastructure abuse, not a software vulnerability - Node.js — node-v24.13.0-win-x64 (legitimate runtime abused as implant host)
Vulnerable versions: N/A - unmodified legitimate binary abused for malicious execution
Remediation for Photo ZIP Campaign Delivers TonRAT Node.js Implant to
Immediate actions
- Block delivery domains and photo-<digits>.zip / photo-*.cfd patterns at email/web gateway
- Block C2 IPs 178.16.54[.]27, 95.217.97[.]121, 193.202.84[.]32, 178.16.55[.]179 and associated non-standard ports (8443, 8445, 8453, 5555, 56001-56003)
- Hunt for and remove HKCU\Software\Microsoft\Windows\CurrentVersion\Run and \RunOnce entries pointing at Node.js interpreters or ProgramData EXEs
- Terminate and remove any unauthorized node.exe processes running from %LOCALAPPDATA%\Nodejs, and delete the runtime and .js payloads
- Remove ProgramData persistence copies (randomly named subfolder + EXE) and any Add-MpPreference -ExclusionProcess entries added for Temp paths
Workarounds
- Disable automatic LNK execution / require explicit confirmation for downloaded shortcut files
- Block execution of csc.exe/cvtres.exe spawned from PowerShell for standard end-user workstations where not required
Longer-term hardening
- Deploy behavioral EDR detection anchored on the full sequence (LNK execution -> PowerShell decode -> %TEMP% staging -> user-space Node.js launch -> Defender exclusion -> ProgramData persistence) rather than static file/hash matching
- Restrict or monitor unauthorized Node.js runtime installation/execution in user-writable directories
- Apply DMARC/authenticated-relay monitoring that flags high-volume templated mail from third-party notification services (e.g., Calendly) even when SPF/DKIM/DMARC pass
- User awareness training for hospitality front-desk/reservation staff on fake guest-complaint and bedbug-report phishing lures
- Restrict script host execution (PowerShell constrained language mode / AppLocker) for LNK-launched child processes
Timeline of Photo ZIP Campaign Delivers TonRAT Node.js Implant to
- Wave 1 of the campaign begins: IMG-<random>.png.lnk delivery leading to PowerShell (obfuscation phases 1-6) directly deploying the Node.js implant, hosted across a wide range of TLDs (.info, .com, .pro, .xyz, .cloud, .icu, .sbs).
- Wave 1 activity continues through April-May 2026 with dozens of rotating C2 domains and consistent LNK builder-tool file sizes (1,989-2,079 bytes) observed.
- Wave 2 begins (late May 2026): LNK naming shifts to PHOTO-<random>.png.lnk, adds a csc.exe/cvtres.exe .NET DLL compilation step before Node.js deployment, and introduces obfuscation phase 7 (for-loop variant).
- Calendly/Google redirect-chain phishing relay (authentication laundering via em1618.calendly[.]com) introduced in Wave 2 to pass SPF/DKIM/DMARC/CompAuth checks.
- Wave 2 infrastructure expands to Cloudflare-fronted photo-*.cfd landing pages behind Turnstile challenges, plus .click and .bond C2 domains.
- Observed incident: Microsoft Defender blocks the initial ProgramData PE payload (detected as Wacatac), but the surviving HKCU\Run Node.js persistence entry resumes C2 communications two days later.
- Malpedia publishes a js.tonrat library entry referencing the Microsoft disclosure.
- Microsoft Security Blog publishes technical analysis of the campaign, naming the implant TonRAT, mapping 15 MITRE ATT&CK techniques, and stating the activity remains unattributed to a known threat actor.
Sources cited for Photo ZIP Campaign Delivers TonRAT Node.js Implant to
- Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
- Malpedia: js.tonrat
- MITRE ATT&CK T1199 - Trusted Relationship
- MITRE ATT&CK T1566.002 - Phishing: Spearphishing Link
- MITRE ATT&CK T1547.001 - Registry Run Keys / Startup Folder
- MITRE ATT&CK T1027.004 - Compile After Delivery
Threats related to Photo ZIP Campaign Delivers TonRAT Node.js Implant to
- TonRAT Node.js Implant Campaign — Photo-Themed ZIP/.LNK Lures Target Hospitality Sector for Persistent Access (Waves 1 & 2)
- Photo ZIP Phishing Campaign Delivering TonRAT via Node.js Abuse Targeting Hospitality Sector
- Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor via PowerShell and TON Blockchain C2 (EtherHiding-style)
- TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry
- TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry
- LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container Runtime to Backdoor Windows Hosts
Detection coverage for TL-2026-1406
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1406 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1406
6 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.