Photo-themed ZIP files target hotel and hospitality staff

Microsoft described on 25 June a campaign targeting hospitality organisations in Europe and Asia. Its lures used photo-themed ZIP archives containing shortcuts that appeared to be image files. Opening them began a staged intrusion that installed a Node.js-based implant and maintained access.

Researchers also observed messages sent through legitimate notification and redirect services, including booking-related lures intended for hotel staff. The report did not attribute the campaign to a known actor, and its ultimate objective remained unclear. A message using a trusted service could still direct a recipient to an attacker’s archive. The relevant checks include the actual file type and requested action, rather than assuming a room enquiry or guest complaint is safe to open.