01Trusted services relay hospitality phishing
Legitimate notification and redirect infrastructure moves hospitality users toward attacker-controlled photo-themed landing pages.
Useful logs: Email, Network, Threat Intelligence
Threat report
Photo ZIP Campaign in 2026: Node JS Persistence
A 2026 hospitality campaign uses trusted-service phishing, fake image shortcuts, obfuscated PowerShell, user-space Node JS, Defender exclusions, dual registry persistence, and rotating C2.
Public research
Reported facts and defensive takeaways are labeled separately.
- Reviewed
Public reporting
What happened
Microsoft identified an active multi-stage campaign targeting hospitality organizations in Europe and Asia from April 2026. The campaign delivers photo-themed archives containing fake image shortcuts, repeatedly changes PowerShell obfuscation, deploys a legitimate Node JS runtime to execute a JavaScript implant, weakens Defender inspection for staged executables, and establishes two registry persistence paths.
- Photo ZIP campaign targeting hospitality industry delivers Node JS implant for persistent access
- Technical Analysis of Suspicious Emails Targeting the Hotel Industry
Why SOC teams should care
The visible artifacts rotate while the behavioral skeleton stays comparatively stable. Trusted web services, legitimate Node JS, PowerShell, common startup keys, and non-standard ports are individually explainable; their sequence is not. Durable detection therefore depends on runtime/path baselines, protection-change correlation, registry persistence, and process-aware network telemetry.
Public reporting
How the attack worked
Initial Access Execution 02Fake image shortcut triggers execution
The downloaded archive contains a shortcut disguised as a PNG and relies on the user opening it.
Useful logs: File, Process, Endpoint
Execution 03PowerShell decodes and retrieves the next stage
Across seven obfuscation phases, syntax changes while arithmetic decoding, web retrieval, and script staging remain stable.
Useful logs: Process, File, Network
Execution 04Wave 2 adds on-host .NET compilation
The second wave adds compiler/resource-converter activity that creates small DLLs before the later runtime stage; Microsoft did not observe those DLLs loaded in available telemetry.
Useful logs: Process, File
Execution 05User-space Node JS executes the implant
A legitimate Node JS runtime is placed under the user profile and executes randomized JavaScript payloads.
Useful logs: Process, File, Network
Defense Evasion 06Defender exclusions precede payload execution
PowerShell adds process exclusions for temporary executables before installer-like or unpacker activity runs.
Useful logs: Process, File, Endpoint
Persistence 07Run and RunOnce preserve two paths
One startup path preserves the Node JS component while a second points to a relocated ProgramData payload; RunOnce can be refreshed after execution.
Useful logs: Registry, Process, File
Remote Access 08Persisted components maintain command-and-control
Compromised systems communicate with fixed or rotating infrastructure over multiple non-standard ports; selected hosts also show browser automation and forced shutdown.
Useful logs: Network, Process, Endpoint
Defensive takeaways
Behavior to watch
A browser or user downloads a photo-themed archive and an IMG/PHOTO shortcut masquerading as a PNG appears or executes.
The fake image shortcut is the user-execution bridge from lure to script execution.
Useful logs: File, Process
PowerShell performs large-integer/arithmetic decoding and immediately retrieves or stages a script.
The implementation changed repeatedly, but the decode-and-download behavior stayed consistent.
Useful logs: Process, Network, File
Node JS begins executing JavaScript from a user-writable profile directory on a device without a development role.
A legitimate runtime becomes the implant interpreter and is especially anomalous on ordinary business endpoints.
Useful logs: Process, File
PowerShell creates a Defender process exclusion and a randomly named temporary executable runs soon afterward.
The short sequence connects protection weakening with follow-on payload execution.
Useful logs: Process, Endpoint
Run/RunOnce values point into the user-space Nodejs directory or randomized ProgramData payload locations.
The dual persistence model is more durable than rotating domains and obfuscation syntax.
Useful logs: Registry, File, Process
RunOnce persistence is recreated after execution instead of behaving as a one-time startup entry.
The refresh loop can complicate remediation and provides a strong hunting pivot.
Useful logs: Registry
Node JS or payloads from user-profile, temporary, or ProgramData paths communicate on unusual high ports.
Process-aware network context can expose active implant control even when destinations rotate.
Useful logs: Network, Process
Logs that help
Email and URL telemetry can expose trusted-service delivery and the multi-hop redirect chain.
- Calendly-associated messages with Booking-style display names.
- Trusted redirect hops followed by photo-themed landing domains.
Process
Process lineage captures shortcut-to-PowerShell, user-space Node JS, protection changes, payload execution, and late-stage automation.
- Fake image shortcut into PowerShell.
- Node JS under a user profile executing JavaScript.
- Defender exclusion commands followed by Temp executables.
File
File telemetry exposes browser origins, fake shortcut naming, temporary payloads, ProgramData relocation, and hash reuse.
- Browser-downloaded photo archive/shortcut.
- Random temporary executables.
- Randomized ProgramData payload paths.
Registry
Registry telemetry provides one of the campaign's most durable and remediation-relevant signals.
- Run values targeting user-space Node JS.
- RunOnce values targeting ProgramData.
- RunOnce entries recreated after execution.
Network
Network telemetry scopes active implant control when joined with process context.
- Node JS or user-space payloads contacting non-standard ports.
- Connections to source-reported destinations.
- Source-specific TON API then WebSocket/C2 behavior.
Defensive takeaways
How to detect this behavior
First-seen user-space Node JS plus startup persistence
Alert when a device without recent user-space Node JS history executes JavaScript from a profile path and creates nearby Run/RunOnce persistence.
Logs needed
- Process events with path/command line and DeviceId.
- Registry value data and initiating process.
- Historical per-device runtime baseline.
Defender exclusion followed by temporary execution
Correlate process-exclusion changes with executable launch from user temporary paths in a short window.
Logs needed
- PowerShell/process command lines.
- Temp executable process path.
- Device correlation.
Defensive takeaways
How to hunt this behavior
Baseline user-space Node JS before hunting the implant
Identify developer/build and approved application populations first, then prioritize first-seen Node JS under user profiles on ordinary endpoints.
What would weaken it
- The device is an approved developer/build system.
- The runtime and workload are long-standing and owned.
Hunt protection change followed by payload execution
Correlating Defender exclusions with temporary executable launch is more durable than matching one random filename.
What would weaken it
- The exclusion/execution belong to managed deployment.
- The payload is owned and the change window is documented.
Track dual startup persistence and RunOnce refresh
Run for Node JS plus RunOnce for ProgramData, especially if RunOnce is recreated, is a strong persistence pattern.
What would weaken it
- Both entries belong to approved software and stable install/update behavior.
Public reporting
Indicators reported by the source
Values are defanged and are not live links.
Calendly-associated subdomain used in the source-reported phishing delivery. Calendly itself is a legitimate service.1 values
- Domain
em1618[.]calendly[.]com
Representative Wave 2 photo-themed landing domain reported by Microsoft.1 values
- Domain
photo-26654[.]cfd
Primary C2 IP reported by Microsoft as active across both waves, including ports 56001 and 56002.1 values
- Ip
178[.]16[.]54[.]27
Wave 1 persistent-beacon infrastructure reported by Microsoft.1 values
- Ip
95[.]217[.]97[.]121
Domain reported by Microsoft as active across both campaign waves.1 values
- Domain
sec-safe-dc[.]info
Representative Wave 1 Node JS implant C2 argument/domain reported by Microsoft.1 values
- Domain
safedocphoto[.]info
PE payload hash Microsoft observed in both waves, supporting campaign continuity.1 values
- Hash
04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1
Wave 1 fake image shortcut naming pattern reported by Microsoft.1 values
- Other
IMG-<digits>.png.lnk
Wave 2 fake image shortcut naming pattern reported by Microsoft.1 values
- Other
PHOTO-<digits>.png.lnk
Source-reported non-standard C2 port family; presence alone is not malicious.1 values
- Other
56001/56002/56003
Legitimate TON API service reported by SOC Prime as used in the related TonRAT chain to obtain C2 information; the service itself is not malicious.1 values
- Domain
tonapi[.]io
TonRAT C2 domain reported by SOC Prime and also referenced in Microsoft's Wave 2 hunting pivots.1 values
- Domain
zloapobikahy23[.]bond
Review record
Sources and limitations
- Reviewed
- Reported window
- April 2026 – June 2026
Observation basis
Microsoft observed activity from April 2026, described Wave 1 through May and Wave 2 from late May into June, and published the broader campaign analysis on June 25. SOC Prime published related hotel-sector analysis on June 12.
Confidence in this conclusion
Microsoft provides cross-organization telemetry, two-wave behavioral analysis, hunting queries, detections, and indicators. SOC Prime independently reported a closely matching hotel-sector ZIP/LNK/PowerShell/Node JS TonRAT chain. Microsoft did not attribute the campaign to a known threat actor.
Limitations
- Microsoft did not attribute the campaign to a known threat actor.
- Wave 2 added .NET compilation and additional infrastructure, so not every host follows every stage.
- Calendly, Google, Cloudflare, Node JS, and the TON API are legitimate and should not be labeled malicious solely because attackers used them.
- SOC Prime's TON API/WebSocket details remain source-scoped and are not forced into every Microsoft-observed host.
- Domains, ports, hashes, and naming patterns are retrospective pivots; the endpoint behavior sequence is more durable.
- The SOC//LIFE Case, Detection, and Hunt are publication-safe defensive reconstructions and are not evidence of a customer incident.
What changed across the waves
Microsoft observed the campaign from April 2026 across hospitality organizations in Europe and Asia. Wave 1 used IMG-style fake image shortcuts and a PowerShell-to-Node JS path. Wave 2 changed the shortcut prefix to PHOTO, added an intermediate .NET compilation stage, and expanded domain infrastructure.
The runtime and persistence design remained more stable than the lure details. A legitimate Node JS runtime under the user profile executed randomized JavaScript, temporary payloads received Defender exclusions, and startup persistence was split across Run and RunOnce.
SOC Prime's earlier hotel-sector analysis independently described a closely matching ZIP/LNK/PowerShell/Node JS TonRAT chain and added a source-specific TON API/WebSocket C2 mechanism. That detail is useful for hunting but is not treated as mandatory for every Microsoft-observed host.
Defensive lesson
Do not turn legitimate service names or Node JS into a blocklist. The useful question is whether an ordinary business endpoint suddenly moves through shortcut execution, script staging, user-space runtime execution, protection changes, dual persistence, and unexplained network activity.
- Photo ZIP campaign targeting hospitality industry delivers Node JS implant for persistent access
Microsoft Security
- Technical Analysis of Suspicious Emails Targeting the Hotel Industry
SOC Prime
- DeviceRegistryEvents
Microsoft Learn
- DeviceFileEvents
Microsoft Learn
Supporting context
ATT&CK mappings
Behavior comes first. These mappings do not imply attribution or complete coverage.
T1566.002· Spearphishing LinkMicrosoft observed phishing links delivered through trusted-service redirect chains.
T1204.002· Malicious FileFake PNG shortcut files require the targeted user to execute disguised content.
T1059.001· PowerShellPowerShell performs the evolving decode-and-download stage.
T1059.007· JavaScriptNode JS interprets the JavaScript implant.
T1547.001· Registry Run Keys / Startup FolderRun and RunOnce values provide dual startup persistence.
T1571· Non-Standard PortLater-stage command-and-control uses multiple non-standard ports.