TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry

TonRAT Phishing Campaign Impersonating Booking.com Targets (TL-2026-2175), also tracked as TONResolver, is a high-severity malware campaign, first published 2026-08-28. It has no confirmed attribution, affects N/A (social-engineering and malware-delivery campaign, not a vendor, maps to 16 MITRE ATT&CK techniques (T1003, T1036, T1057), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-2175

Threat ID
TL-2026-2175
Also known as
TONResolver, TrojanSpy.JS.TONRESOLVER.A
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-28
Last reviewed
2026-08-28
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
hospitality, hotel, travel
Target regions
japan, austria, australia, france, germany, indonesia, italy, netherlands, russia, south korea, turkey, united kingdom
Detection rules
9
Indicators of compromise
21

Malware and tooling in TonRAT Phishing Campaign Impersonating Booking.com Targets

Malware and tooling: TonRAT, Node.js v24.13.0, Obfuscator.io

A phishing campaign impersonating Booking.com Partner Support abused Calendly/SendGrid infrastructure and Google-shortened redirect links to deliver a JavaScript remote access trojan dubbed TonRAT (aka TONResolver) to hotel operator staff, primarily in Japan. TonRAT resolves its command-and-control domain dynamically via the TON blockchain (a 'dead drop resolver' pattern) and communicates over an AES/ECDH-encrypted WebSocket channel; the campaign has been tied to unauthorized access and modification of victim hotel bank account information, and impersonation activity is reportedly still ongoing.

How TonRAT Phishing Campaign Impersonating Booking.com Targets works

Between May and June 2026, ITOCHU Cyber & Intelligence identified a multi-stage phishing campaign impersonating Booking.com Partner Support and targeting Japanese hotel operating companies that partner with Booking.com. Rather than compromising Booking.com itself, the operators hijacked or spoofed the affiliate-support relationship and abused the Calendly scheduling platform's email-notification pipeline (routed through SendGrid, o3.sg.calendly[.]com / 149.72.248[.]16) to send phishing emails with attacker-controlled Reply-To addresses. Because the emails originated from Calendly's legitimate mail infrastructure, they were able to pass SPF/DKIM/DMARC checks that would normally flag a spoofed sender.

The emails contained Calendly links that redirected through a Google URL shortener to a malicious ZIP archive. The archive contained a Windows shortcut (.lnk) file disguised as a photo (double extension, e.g. 'PHOTO-819427133.png.lnk') alongside a decoy MP4. Opening the .lnk file silently launched an embedded PowerShell command that downloaded a second, obfuscated PowerShell script from an attacker-controlled '.cfd' domain (photo-26654[.]cfd and related photo-#####.cfd variants). That second-stage script decrypted (AES-256-CBC) an embedded JavaScript payload -- the TonRAT implant -- and downloaded a legitimate Node.js v24.13.0 runtime directly from nodejs.org to execute it from a user-writable path (AppData\Local\Nodejs), avoiding the need for a compiled malicious binary.

TonRAT's most distinctive feature is its use of the TON (The Open Network) blockchain as a dead-drop resolver: the implant queries the public tonapi.io API for a smart-contract-stored value to obtain its current WebSocket command-and-control domain at runtime, letting the operators rotate infrastructure (observed moving from zloapobikahy23[.]bond to tonajukbhuakpo2[.]shop in early June 2026) without needing to recompile or re-deliver the malware. The WebSocket channel (wss://tonajukbhuakpo2[.]shop/w) is further encrypted using ECDH (secp256k1) key exchange and AES-256-CBC, with a custom Base64 alphabet layered on top. Observed RAT capabilities include system-information exfiltration (hostname, username, OS, CPU, MAC, architecture, memory), arbitrary remote command execution with result exfiltration, and follow-on browser-credential and LSASS-adjacent credential access. For defense evasion, the malware hides its PowerShell console window via the ShowWindow Windows API, adds a Windows Defender path exclusion for %temp%\*.exe via Add-MpPreference, checks for already-running node.exe processes, and packs its JavaScript with Obfuscator.io VM-based obfuscation (expanding to roughly 17,000 lines of obfuscated code). Persistence is established via the HKCU\...\CurrentVersion\Run registry key.

By June 2026 it was publicly disclosed that unauthorized access via this campaign led to modification of victim hotel bank account information, resulting in financial losses at affected Japanese hotel operators. Independent reporting from Trend Micro (tracking the implant as TrojanSpy.JS.TONRESOLVER.A / 'TONResolver') and, per Security Affairs, from Microsoft Threat Intelligence describes a broader and evolving version of the same campaign: guest-complaint and health/bedbug-inspection themed lures in additional languages (Japanese, Danish, Dutch, and others), 'authentication laundering' via Calendly/Google redirect abuse, dual Registry Run/RunOnce persistence, and fixed-IP C2 over non-standard ports (56001-56003, 8443, 8445, 8453, 5555) in addition to the TON-resolved WebSocket channel, with secondary targeting observed beyond Japan (Austria, Australia, France, Germany, Indonesia, Italy, Netherlands, Russia, South Korea, Turkey, UK, US). No specific threat actor has been publicly attributed; the campaign's financial-fraud outcome (bank account modification) points to a financially motivated actor. ITOCHU's August 2026 English-language republication notes that Booking.com-impersonation phishing activity of this kind continues to be observed in the wild.

MITRE ATT&CK techniques used in TL-2026-2175

Credential Access

T1003 OS Credential Dumping; T1555 Credentials from Password Stores

Defense Evasion

T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1571 Non-Standard Port; T1573 Encrypted Channel

Persistence

T1547 Boot or Logon Autostart Execution

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in TonRAT Phishing Campaign Impersonating Booking.com Targets

  • N/A (social-engineering and malware-delivery campaign, not a vendor product vulnerability) — Windows workstations operated by Booking.com partner hotel operator staff
    Vulnerable versions: Any Windows host where a user opens the malicious .lnk file and allows the PowerShell/Node.js chain to run
    Fixed in: N/A

Remediation for TonRAT Phishing Campaign Impersonating Booking.com Targets

Patches

  • Not applicable -- this is a social-engineering and malware-delivery campaign, not a software vulnerability; no vendor patch exists

Immediate actions

  • Block/sinkhole known malicious domains and the WebSocket C2 endpoint at DNS, proxy, and firewall layers: photo-21454[.]cfd, photo-26654[.]cfd, zloapobikahy23[.]bond, tonajukbhuakpo2[.]shop, and wss://tonajukbhuakpo2[.]shop/w
  • Alert on outbound connections to tonapi[.]io from endpoint subnets that have no legitimate TON/blockchain development use case
  • Hunt across EDR, proxy, and email-gateway logs for the published SHA256 hashes of the ZIP, .lnk, PowerShell, and JavaScript samples
  • Review and, where warranted, reset credentials and verify the integrity of any hotel banking/payment configuration accessible from potentially compromised endpoints

Workarounds

  • Restrict or closely monitor Calendly notification emails and Google URL-shortener redirects at the secure email gateway where not business-required
  • Require multi-person, out-of-band approval for any change to hotel banking or payment account details regardless of the requesting channel

Longer-term hardening

  • Block or strip .lnk files delivered as email attachments or inside archive attachments at the secure email gateway
  • Enforce PowerShell constrained language mode / script-block logging and alert on hidden-window PowerShell launches (ShowWindow API abuse)
  • Monitor for and restrict portable/unsigned Node.js runtime downloads and execution from user-writable paths such as AppData\Local\Nodejs
  • Alert on Windows Defender exclusion changes made via Add-MpPreference by non-administrative processes
  • Train hotel partner front-desk, reservations, and finance staff to verify Booking.com Partner Support communications out-of-band and treat unsolicited guest-complaint/review-request emails with embedded links as suspicious

Timeline of TonRAT Phishing Campaign Impersonating Booking.com Targets

  • Microsoft Threat Intelligence's later reporting (via Security Affairs) places related TonRAT / authentication-laundering campaign activity as active from April 2026, ahead of the May wave ITOCHU directly observed.
  • ITOCHU Cyber & Intelligence begins observing phishing emails impersonating Booking.com Partner Support sent to Japanese hotel partner staff via Calendly/SendGrid infrastructure and Google-shortened redirect links ('late May 2026').
  • It is publicly disclosed that unauthorized access via this campaign resulted in modification of victim hotel bank account information at Japanese hotel operators, causing financial losses.
  • C2 domain zloapobikahy23[.]bond is last observed active before the operators rotate infrastructure, per ITOCHU's technical analysis.
  • TonRAT operators switch the primary C2 domain to tonajukbhuakpo2[.]shop, resolved dynamically via the TON blockchain API rather than hardcoded.
  • ITOCHU Cyber & Intelligence publishes its Japanese-language Part 1 (campaign overview) and Part 2 (technical analysis) blog posts on the TonRAT campaign.
  • Security Affairs reports on Microsoft Threat Intelligence's analysis of an expanded, related TonRAT campaign spanning multiple countries/languages, fixed-IP non-standard-port C2, and dual Registry Run/RunOnce persistence.
  • Trend Micro (TrendAI Research) publishes 'TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry,' tracking the implant as TrojanSpy.JS.TONRESOLVER.A and documenting secondary targeting beyond Japan.
  • ITOCHU Cyber & Intelligence publishes English-language translations of Part 1 and Part 2, noting that Booking.com-impersonation phishing activity of this kind continues to be observed in the wild.

Sources cited for TonRAT Phishing Campaign Impersonating Booking.com Targets

More in malware

Detection coverage for TL-2026-2175

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2175 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2175

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats