Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

Microsoft Security Blog posts report multiple active and high-risk campaigns and research: a multi-stage Photo ZIP campaign targets hospitality organizations in Europe and Asia using photo-themed ZIPs and fake image shortcut files to deliver a persistent Node.js implant that evades detection; Microsoft DCU disrupted infrastructure supporting StealC and Amadey infostealers and provides technical breakdowns; AutoJack research demonstrates an RCE chain allowing a single malicious webpage to achieve remote code execution on hosts running AI browsing agents by abusing localhost/MCP WebSocket trust;