Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

Microsoft Threat Intelligence describes an active, multi-stage intrusion campaign (since April 2026) against hospitality organizations that delivers photo-themed ZIP archives containing fake image LNK files; execution triggers heavily obfuscated PowerShell BigInt decoders that fetch scripts, optionally compile small .NET DLLs, and deploy a Node.js implant (TonRAT) which achieves dual persistence via HKCU\Run (Node.js) and HKCU\RunOnce (ProgramData PE). The actor abuses legitimate services (Calendly + Google redirects) to bypass email authentication, uses Cloudflare-fronted *.cfd* landing pages, rotates domains/IPs and non-standard C2 ports, modifies Defender exclusions, and demonstrates resilience to remediation; the report includes IOCs, MITRE ATT&CK mappings, advanced hunting queries, and mitigation guidance.