Microsoft warns of phishing campaign targeting hotels with Node.js implant
- Evelyn Carter
- Jun 29
- 3 min read
Since April 2026, a sophisticated phishing campaign has been targeting hotels across Asia and Europe. The attackers abuse trusted services including Calendly and Google to distribute a ZIP archive containing the TonRAT malware, which is executed through the legitimate Node.js v24.13.0 runtime. The malware then establishes outbound communications over unusual network ports ranging from 8443 to 56003.
Microsoft has issued an urgent warning about a large-scale phishing campaign actively targeting hotels and the hospitality sector across Europe and Asia. The campaign employs advanced social engineering and malware delivery techniques designed to bypass traditional email security controls and compromise front desk workstations.
Why do the phishing emails bypass authentication checks?
One of the most notable aspects of the campaign is the attackers' abuse of Calendly's email notification infrastructure combined with Google's URL redirection services to distribute malicious links.
Microsoft refers to this technique as authentication laundering. Because the phishing emails originate from Calendly's legitimate infrastructure, they successfully pass SPF, DKIM, and DMARC authentication checks.
After victims click the embedded link, they are redirected through multiple trusted services, including Calendly, Google-hosted file-sharing services, another Google redirector, and finally to a newly registered .cfd domain protected by Cloudflare. The landing page also implements Cloudflare Turnstile to hinder automated security analysis.
How does the TonRAT malware operate?
Microsoft tracks the implant under the name TonRAT. Once executed, TonRAT leverages the TON blockchain API to dynamically resolve its command-and-control (C2) domain before establishing an encrypted WebSocket connection with the attacker-controlled infrastructure.
At the time of publication, Microsoft has not confirmed any evidence of data exfiltration, ransomware deployment, or publicly identified any affected organizations.
What should incident responders investigate?
Administrators should:
Remove the RunOnce registry key pointing to the ProgramData directory.
Delete the Node.js Run registry key.
Remove all associated Node.js runtime files and malicious JavaScript files located under AppData\Local\Nodejs.
Removing only one persistence mechanism allows the implant to reinstall itself and remain active on the compromised system. Systems used by front desk staff, reservation teams, and guest service offices should be prioritized during incident response activities.
Suspicious behaviors observed after compromise
Security researchers from SOC Prime and ITOCHU observed additional post-compromise behaviors, including:
Launching hidden browser instances
Performing geolocation checks on infected systems
Executing remote shutdown commands
To date, researchers have not determined the attackers' ultimate objectives, and there is currently no evidence linking the campaign to ransomware deployment or confirmed data theft.
How can organizations fully remediate the threat?
Complete remediation requires removing both malware persistence paths, including the RunOnce entry in the ProgramData directory and the Node.js Run registry key.
Organizations should conduct thorough forensic reviews of systems used for guest reception, reservation management, and administrative operations. Removing only part of the malware allows TonRAT to regain persistence and continue operating within the environment.
What is the solution for protecting an organization's digital shield?
To ensure enterprise systems remain protected against the increasingly complex global cybersecurity landscape, organizations should consider working with trusted cybersecurity and IT service providers.
IPSIP Vietnam provides comprehensive cybersecurity and IT services designed to help businesses strengthen their security posture and respond effectively to emerging threats.
IPSIP Vietnam's management and monitoring systems have successfully passed rigorous assessments to achieve internationally recognized ISO 27001:2022 and SOC 2 Type II information security certifications. Through its core 24/7 services, including a Security Operations Center (SOC 24/7), a Network Operations Center (NOC 24/7), and dedicated IT support and helpdesk teams, IPSIP is committed to continuously monitoring, responding to, and blocking cyber intrusion attempts around the clock.
References
Comments