TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry — Threadlinqs Intelligence
As of 2026-08-28, TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-2175 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
A phishing campaign impersonating Booking.com Partner Support abused Calendly/SendGrid infrastructure and Google-shortened redirect links to deliver a JavaScript remote access trojan dubbed TonRAT
Between May and June 2026, ITOCHU Cyber & Intelligence identified a multi-stage phishing campaign impersonating Booking.com Partner Support and targeting Japanese hotel operating companies that partner with Booking.com. Rather than compromising Booking.com itself, the operators hijacked or spoofed the affiliate-support relationship and abused the Calendly scheduling platform's email-notification pipeline (routed through SendGrid, o3.sg.calendly[.]com / 149.72.248[.]16) to send phishing emails with attacker-controlled Reply-To addresses. Because the emails originated from Calendly's legitimate mail infrastructure, they were able to pass SPF/DKIM/DMARC checks that would normally flag a spoofed sender.
The emails contained Calendly links that redirected through a Google URL shortener to a malicious ZIP archive. The archive contained a Windows shortcut (.lnk) file disguised as a photo (double extension, e.g. 'PHOTO-819427133.png.lnk') alongside a decoy MP4. Opening the .lnk file silently launched an embedded PowerShell command that downloaded a second, obfuscated PowerShell script from an attacker-controlled '.cfd' domain (photo-26654[.]cfd and related photo-#####.cfd variants). That second-stage script decrypted (AES-256-CBC) an embedded JavaScript payload -- the TonRAT implant -- and downloaded a legitimate Node.js v24.13.0 runtime directly from nodejs.org to execute it from a user-writable path (AppData\Local\Nodejs), avoiding the need for a compiled malicious binary.
TonRAT's most distinctive feature is its use of the TON (The Open Network) blockchain as a dead-drop resolver: the implant queries the public tonapi.io API for a smart-contract-stored value to obtain its current WebSocket command-and-control domain at runtime, letting the operators rotate infrastructure (observed moving from zloapobikahy23[.]bond to tonajukbhuakpo2[.]shop in early June 2026) without needing to recompile or re-deliver the malware. The WebSocket channel (wss://tonajukbhuakpo2[.]shop/w) is further encrypted using ECDH (secp256k1) key exchange and AES-256-CBC, with a custom Base64 alphabet layered on top. Observed RAT capabilities include system-information exfiltration (hostname, username, OS, CPU, MAC, architecture, memory), arbitrary remote command execution with result exfiltration, and follow-on browser-credential and LSASS-adjacent credential access. For defense evasion, the malware hides its PowerShell console window via the ShowWindow Windows API, adds a Windows Defender path exclusion for %temp%\*.exe via Add-MpPreference, checks for already-running node.exe processes, and packs its JavaScript with Obfuscator.io VM-based obfuscation (expanding to roughly 17,000 lines of obfuscated code). Persistence is established via the HKCU\...\CurrentVersion\Run registry key.
By June 2026 it was publicly disclosed that unauthorized access via this campaign led to modification of victim hotel bank account information, resulting in financial losses at affected Japanese hotel operators. Independent reporting from Trend Micro (tracking the implant as TrojanSpy.JS.TONRESOLVER.A / 'TONResolver') and, per Security Affairs, from Microsoft Threat Intelligence describes a broader and evolving version of the same campaign: guest-complaint and health/bedbug-inspection themed lures in additional languages (Japanese, Danish, Dutch, and others), 'authentication laundering' via Calendly/Google redirect abuse, dual Registry Run/RunOnce persistence, and fixed-IP C2 over non-standard ports (56001-56003, 8443, 8445, 8453, 5555) in addition to the TON-resolved WebSocket channel, with secondary targeting observed beyond Japan (Austria, Australia, France, Germany, Indonesia, Italy, Netherlands, Russia, South Korea, Turkey, UK, US). No specific threat actor has been publicly attributed; the campaign's financial-fraud outcome (bank account modification) points to a financially motivated actor. ITOCHU's August 2026 English-language republication notes that Booking.com-impersona
Target sectors: hospitality, hotel, travel
Target regions: japan, austria, australia, france, germany, indonesia, italy, netherlands, russia, south korea, turkey, united kingdom
Timeline
- Microsoft Threat Intelligence's later reporting (via Security Affairs) places related TonRAT / authentication-laundering campaign activity as active from April 2026, ahead of the May wave ITOCHU directly observed.
- ITOCHU Cyber & Intelligence begins observing phishing emails impersonating Booking.com Partner Support sent to Japanese hotel partner staff via Calendly/SendGrid infrastructure and Google-shortened redirect links ('late May 2026').
- C2 domain zloapobikahy23[.]bond is last observed active before the operators rotate infrastructure, per ITOCHU's technical analysis.
- It is publicly disclosed that unauthorized access via this campaign resulted in modification of victim hotel bank account information at Japanese hotel operators, causing financial losses.
- TonRAT operators switch the primary C2 domain to tonajukbhuakpo2[.]shop, resolved dynamically via the TON blockchain API rather than hardcoded.
- ITOCHU Cyber & Intelligence publishes its Japanese-language Part 1 (campaign overview) and Part 2 (technical analysis) blog posts on the TonRAT campaign.
- Security Affairs reports on Microsoft Threat Intelligence's analysis of an expanded, related TonRAT campaign spanning multiple countries/languages, fixed-IP non-standard-port C2, and dual Registry Run/RunOnce persistence.
- Trend Micro (TrendAI Research) publishes 'TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry,' tracking the implant as TrojanSpy.JS.TONRESOLVER.A and documenting secondary targeting beyond Japan.
- ITOCHU Cyber & Intelligence publishes English-language translations of Part 1 and Part 2, noting that Booking.com-impersonation phishing activity of this kind continues to be observed in the wild.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1566, T1204, T1059, T1547, T1036, T1140, T1564, T1685, T1057
