Three Angry Hotel Guests, Two Hijacked Mailboxes, One Script

A targeted phishing campaign used compromised institutional mailboxes (an Asian business association and a Latin American ministry) to send grievance- and legal-threat-themed emails to a UK luxury hotel, leveraging authenticated SMTP and Google share links to lure staff into clicking. Analysts linked the sends by a unique Message-ID format consistent with a single sending script and captured IOCs (three Google share URLs, an IP literal, and the Message-ID pattern); no payload was observed but the campaign exploited trusted senders and human response workflows.