Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

Microsoft Threat Intelligence identified an active, multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia. The attackers use photo-themed ZIP archives and fake image shortcut files to deliver a persistent Node.js implant that evades detection and maintains long-term access. The campaign leverages social-engineered lures, staged loaders, and persistence mechanisms to target the hospitality sector and should be treated as a high-risk intrusion vector for affected organizations.