Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia. Attackers deliver photo-themed ZIP archives containing fake image shortcut files that drop a persistent Node.js implant to establish long-term access and evade detection. Campaign features social‑engineering lures (image-themed archives), use of shortcuts to bypass simple controls, multi-stage payload delivery, and persistence mechanisms enabling follow‑on activity.