Node.js Hospitality Phishing Campaign Hits Hotel Staff

Introduction

Microsoft has uncovered an active multi-stage campaign targeting hospitality and hotel organizations across Europe and Asia. For security teams, this is notable because the attacker blends phishing, trusted-service abuse, PowerShell, and a Node.js implant to gain persistent access while reducing the chance of early detection.

What’s new

The campaign uses photo-themed ZIP archives delivered through browser downloads, often linked from phishing emails. Inside the archive is a malicious LNK file disguised as an image, such as IMG-<random>.png.lnk or PHOTO-<random>.png.lnk.

Key observed behaviors include:

• Hospitality-focused lures using themes like guest complaints, room inquiries, stay reviews, and bedbug reports
• Abuse of legitimate services including Calendly email notifications and Google URL redirects
• Authentication laundering, where phishing messages appear more trustworthy by passing through legitimate sending infrastructure
• Obfuscated PowerShell downloaders that launch follow-on stages
• Node.js-based implant deployment for persistence and command-and-control
• Dual registry persistence to maintain access after reboot
• C2 over non-standard ports to help blend malicious traffic
• Wave 2 enhancements, including dynamic .NET DLL compilation via csc.exe and expanded .cfd domain infrastructure behind Cloudflare

Microsoft says post-compromise activity has included beaconing, forced shutdowns, and compilation of PE payloads. While the final objective is still unclear, the level of persistence and obfuscation suggests preparation for additional malicious activity.

Impact on IT administrators

This campaign is especially relevant for organizations with front desk, reservations, and reception staff who regularly open files related to guests and bookings. Because the phishing emails use familiar business themes and trusted platforms, standard user awareness and email authentication checks may not be enough on their own.

Security teams should also note the cross-platform tooling involved. A Node.js implant can be less common in enterprise malware investigations, so defenders may need to expand detection logic beyond typical PE-only assumptions.

Recommended next steps

IT and security teams should consider the following actions:

• Block or closely monitor LNK files downloaded from browsers and email-linked archives
• Hunt for suspicious execution of PowerShell, csc.exe, and unexpected Node.js activity on user endpoints
• Review detections for registry-based persistence and outbound traffic on non-standard ports
• Tighten controls around phishing redirects and inspect links delivered through legitimate third-party services
• Prioritize awareness training for hospitality-facing staff on image-themed ZIP attachments and complaint-based lures
• Use Microsoft Defender threat intelligence, detections, and investigation guidance from the original research to validate current protections

For defenders in hospitality, this is a strong reminder that socially engineered file execution remains effective when paired with evasive post-exploitation techniques.