Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
2026-06-27T20:52:17Z•6a7be6ecac1dc540a46590937ca5d9e8f8e55e08d0b78b4268564a9b2e68d124
ai agentamadeyasiaautojackbrowser-based exploitclipboard theft','wallet replacement'crypto clippereuropefake image shortcuthospitality sectorinfostealermastranode.js implantnpm supply chainpersistencephishingphoto-zip campaignrcesapphire sleetstealcsupply chain compromisetakedowntorworm-like propagationzip archive
What happened
Microsoft Threat Intelligence describes multiple active and emerging threats: a multi-stage “Photo ZIP” phishing campaign targeting hospitality organizations in Europe and Asia that uses photo-themed ZIPs and fake image shortcut files to deliver a persistent Node.js implant designed to evade detection; takedowns and technical analysis of infostealers (StealC and Amadey) and their supporting infrastructure; a poisoned npm package (Mastra) supply-chain compromise by actor Sapphire Sleet that infected many projects via postinstall payloads; AutoJack, an exploit chain that can enable remote code‑e
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 6a7be6ecac1dc540a46590937ca5d9e8f8e55e08d0b78b4268564a9b2e68d124
- Enrichment time
- 2026-06-27T20:52:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.