Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
2026-06-28T08:52:16Z•1e79adbf7f20c10754181be9f4e5097e0ec69b6da7d84899dd29870d19ea6856
AsiaEuropeNode.js implantevasionhospitality sectormalicious shortcut (LNK/SCF)multi-stage intrusionpersistencephishing attachmentphoto-themed ZIP
What happened
Microsoft Threat Intelligence uncovered an active, multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia. The attack uses photo-themed ZIP attachments containing fake image shortcut files to deliver and execute a Node.js-based implant that provides persistent, stealthy access and evades detection through multi-stage loaders and artifact camouflage.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 1e79adbf7f20c10754181be9f4e5097e0ec69b6da7d84899dd29870d19ea6856
- Enrichment time
- 2026-06-28T08:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.