Phishing emails carrying malicious zip files disguised as guest photographs are targeting hotels and other hospitality organizations across Europe and Asia, with attackers aiming not for immediate payout but for long-term access to compromised systems. Microsoft has tracked the intrusion campaign since at least April; Trend Micro documented parallel activity in May against Booking.com partner companies in Japan.

Both campaigns rely on the same social engineering playbook. Attackers impersonate guests with complaints, health inspection notices, reservation issues or stay review requests — messages that front-desk staff and reservation teams handle as routine business. Neither company confirmed whether the two sets of activity are linked, and neither responded to requests for comment.

How do the attacks work?

Victims who click embedded links download zip archives containing photo-themed Windows shortcut (LNK) files. Opening the shortcut triggers an obfuscated PowerShell infection chain. Microsoft's report describes the final payload as a persistent Node.js implant that creates multiple registry-based persistence mechanisms and establishes encrypted communications with attacker-controlled infrastructure.

The technique of delivering malware through zip archives and fake image shortcuts has grown more popular as Microsoft has restricted macro-based malware delivery. Attackers also abuse legitimate services to add credibility. Microsoft said the phishing emails misused Calendly's email notification system and Google's URL redirection service to bypass conventional authentication checks through a technique the company calls "authentication laundering."

"By routing phishing messages through a trusted service's sending infrastructure, the threat actor can make malicious messages appear similar to legitimate notifications to email authentication defenses," the Microsoft researchers wrote.

Trend Micro's campaign, discovered in late May against Japanese accommodation providers partnered with Booking.com, delivers a different payload: TONResolver, a JavaScript-based remote access trojan. The malware gains initial access and can receive and execute further attacker commands. Trend Micro observed evidence of subsequent credential theft and additional compromise after the initial infection.

Why is blockchain part of the attack chain?

TONResolver's command-and-control architecture stands out. The malware retrieves its current C2 destination from a smart contract on The Open Network (TON) blockchain, abusing TON as a dead-drop resolver to hide server addresses inside legitimate web services and evade detection.

Denis Calderone, principal and chief technology officer at Suzu Labs, said the technique makes takedowns largely ineffective. "If the C2 server gets taken down, the attacker just updates the domain inside the smart contract and every infected machine reconnects automatically," he said. "There's no server to seize and no domain to sinkhole. Traditional takedown playbooks don't work against this."

The same blockchain C2 approach appeared recently in the Trivy supply chain attack. "It does seem that the attackers are learning from each other, and blockchain C2 is moving from novel to adopted," Calderone said.

What should hospitality operators do now?

Rather than deploy ransomware or seek an immediate financial reward, the operators appear focused on establishing reliable remote access they can exploit later for credential theft, lateral movement or additional payloads. That persistence model poses particular risk to hotel groups, where a single compromised reservation terminal can expose guest data and booking-platform credentials at scale.

Microsoft advised organizations to:

• Treat photo-themed zip archives and fake image shortcuts as high-risk
• Harden and monitor PowerShell execution
• Monitor for unexpected .NET compilation
• Investigate Node.js execution from user-space paths

Trend Micro recommended deploying a proxy gateway on internet-facing endpoints and performing connection filtering. "Normally, the need for business environments to access blockchain platforms is considered limited," the researchers wrote. "If such communication is unnecessary, pre-emptively implementing connectivity restrictions can sever the attack chain at an intermediate stage."

Calderone advised security administrators to "trust little," particularly on front-desk workstations. "Restrict PowerShell and Node.js execution on front-desk and reservation systems at a minimum," he said. "These workstations have no legitimate reason to run Node.js. If you see node.exe spawning on a reservations terminal, that's your indicator."

Both Microsoft and Trend Micro published indicators of compromise with their reports. Operators should expect further reporting on whether the two campaigns are connected, and broader adoption of blockchain-based C2 as attackers learn from each other's techniques.