Photo ZIP Campaign Targets Hotels With Persistent Node.js Implant
Summary
Microsoft reports a campaign targeting hospitality organizations in Europe and Asia with fake image shortcuts and a Node.js implant. Phishing messages abuse Calendly and Google redirects; the actor and ultimate objective remain unknown.
Key points
- Microsoft has tracked the campaign since April 2026 and has not attributed it to a known threat actor.
- Phishing lures use Calendly notifications and Google redirects to deliver photo-themed ZIP archives containing executable shortcuts disguised as PNG images.
- Opening a shortcut launches an obfuscated PowerShell decoder that downloads a script and leads to a Node.js implant; a later wave also introduced on-device .NET DLL compilation.
- The implant adds Defender process exclusions and uses registry Run and RunOnce entries to maintain separate Node.js and ProgramData execution paths.
- On one compromised device, Node.js persistence survived a payload block and resumed command-and-control activity approximately two days later.
- Microsoft observed browser automation, network-context lookups and forced shutdowns on some affected devices; the campaign’s ultimate objective remains unclear.
- Microsoft recommends investigating the full execution chain and removing both persistence entries, the Node.js runtime and associated scripts during remediation.
Article Details
- Attack Vectors
- Phishing messages sent through Calendly notifications used multilingual hospitality-themed lures and redirects to photo-themed ZIP downloads.
- ZIP archives contained shortcut files disguised as PNG images. Opening a shortcut launched an obfuscated PowerShell downloader.
- Downloaded scripts deployed a Node.js implant; Wave 2 also compiled a DLL locally, although Microsoft did not observe the DLL being loaded.
- Defensive Notes
- Hunt for photo-themed ZIPs and fake image shortcuts followed by PowerShell decoding, temporary script staging, and Node.js execution from user directories.
- Investigate PowerShell-initiated csc.exe and cvtres.exe compilation, Defender exclusions for temporary executables, and silent installer activity.
- Remove both the Node.js Run key and the ProgramData RunOnce entry during remediation, along with the associated Node.js runtime and JavaScript files.
- Review connections to the reported C2 ports and recently registered photo-themed .cfd domains; investigate headless browser execution and forced shutdowns on affected hosts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aluminiostramuntana[.]com | Wave 2 C2 domain. |
| DOMAIN | ginrinsou[.]com | Legitimate domain suspected of being compromised and used as an alternate sending relay. |
| DOMAIN | higoksbupwou[.]com | Wave 2 C2 domain. |
| DOMAIN | kelopins[.]info | C2 domain passed as an argument to the Node.js implant. |
| DOMAIN | kentjerk[.]info | C2 domain passed as an argument to the Node.js implant. |
| DOMAIN | photo-132454[.]cfd | Wave 2 phishing landing domain. |
| DOMAIN | photo-21473[.]xyz | Wave 2 C2 domain. |
| DOMAIN | photo-26254[.]cfd | Wave 2 phishing landing domain. |
| DOMAIN | photo-26653[.]cfd | Short-lived Wave 2 phishing landing domain. |
| DOMAIN | photo-26654[.]cfd | Wave 2 phishing landing domain used to deliver photo-themed ZIP archives. |
| DOMAIN | photo-26656[.]cfd | Short-lived Wave 2 phishing landing domain. |
| DOMAIN | photo-27857[.]cfd | Short-lived Wave 2 phishing landing domain. |
| DOMAIN | photo-7216102[.]click | Wave 2 C2 domain. |
| DOMAIN | photo-8632454[.]cfd | Wave 2 phishing landing domain. |
| DOMAIN | photodoc-secure[.]info | C2 domain passed as an argument to the Node.js implant. |
| DOMAIN | recallnine[.]info | C2 domain passed as an argument to the Node.js implant. |
| DOMAIN | safedocphoto[.]info | C2 domain passed as an argument to the Node.js implant. |
| DOMAIN | sec-safe-dc[.]info | C2 domain observed in both campaign waves. |
| DOMAIN | zloapobikahy23[.]bond | Wave 2 C2 domain. |
| IPV4 | 178[.]16[.]54[.]27 | C2 IP active across both campaign waves on ports 56001 and 56002. |
| IPV4 | 178[.]16[.]55[.]179 | Additional Wave 1 C2 IP. |
| IPV4 | 193[.]202[.]84[.]32 | Secondary Wave 1 C2 IP. |
| IPV4 | 95[.]217[.]97[.]121 | Wave 1 C2 beaconing IP. |
| SHA256 | 04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1 | Hash of xmnrwv9l.exe, a PE payload observed in both waves and blocked on one device. |
| SHA256 | 06a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e227969 | Hash of a Wave 1 campaign payload. |
| SHA256 | 83e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b7 | Hash of a Wave 1 campaign payload. |
| SHA256 | 97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f | Hash of the Wave 2 malicious PHOTO-215746435.png.lnk shortcut. |
| SHA256 | 9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2 | Hash of the malicious IMG-386443483.png.lnk shortcut. |
| SHA256 | b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6bea | Hash of bjygtujc.dll, compiled on a target during Wave 2. |
| SHA256 | c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5 | Hash of qFWe908J.ps1, a Wave 2 PowerShell script. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryCompromised devices queried ip-api.com for external network context.T1027 · Obfuscated Files or InformationThe PowerShell downloader evolved through seven phases of arithmetic and syntax obfuscation.T1027.004 · Compile After DeliveryWave 2 scripts triggered csc.exe and cvtres.exe to compile small DLLs on target devices.T1036 · MasqueradingExecutable LNK files used .png.lnk names to masquerade as image files.T1059.001 · PowerShellAn obfuscated PowerShell BigInt decoder retrieved and executed a subsequent .ps1 script.T1059.007 · JavaScriptThe implant used Node.js to execute JavaScript payloads with C2 domain arguments.T1204.002 · Malicious FileThe attack required recipients to open a shortcut disguised as a PNG image.T1547.001 · Registry Run Keys / Startup FolderHKCU Run launched the Node.js implant while a repeatedly refreshed RunOnce entry launched a ProgramData payload.T1562.001 · Disable or Modify ToolsThe campaign added Defender process exclusions for randomly named executables in temporary paths.T1566.002 · Spearphishing LinkPhishing notifications contained redirect links leading to photo-themed payload downloads.T1571 · Non-Standard PortC2 beaconing used ports including 8443, 8445, 8453, 5555, and 56001–56003.T1583.001 · DomainsThe operator registered and rotated short-lived photo-themed landing domains.T1583.006 · Web ServicesAn actor-controlled Calendly account and Google redirect tokens were used to relay phishing.T1584.006 · Web ServicesMicrosoft reported suspected use of a compromised legitimate domain as an alternate sending relay.
People
Malware
Vendors
Products
CalendlyThe campaign abuses Calendly and Google redirect infrastructure for phishing delivery, evolves across two waves with added .NET compilation and Cloudflare-fronted .cfd domains, and shares indicators linked to TonRAT,DefenderThe Node.js implant runs from user-space paths, adds Defender exclusions, stages payloads in ProgramData, and maintains persistence through HKCU Run and RunOnce keys.Microsoft Defender XDRMicrosoft Defender XDR detections Node.jsEurope and Asia that uses photo-themed ZIP archives, fake image shortcut files, obfuscated PowerShell, Node.js implants, and dual registry persistence.
Industries
HospitalityMicrosoft Threat Intelligence identified a multi-stage campaign targeting hospitality and hotel organizations across Europe and Asia that uses photo-themed ZIP archives, fake image shortcut files, obfuscated PowerShell,HotelsMicrosoft Threat Intelligence identified a multi-stage campaign targeting hospitality and hotel organizations across Europe and Asia that uses photo-themed ZIP archives, fake image shortcut files, obfuscated PowerShell,