Threat actors have found a reliable vulnerability hiding in plain sight: the hospitality industry's instinctive obligation to respond to guest concerns. An active malware campaign running since at least April 2026 has been systematically targeting hotel front desks, reception staff, and reservations teams with carefully crafted fake complaint emails — weaponizing professional courtesy to deliver a sophisticated remote access trojan with unusually durable persistence mechanisms.
A Victim Profile Built on Operational Reality
The precision of this campaign is immediately apparent in how its operators selected their targets. Compromised device names recovered from affected environments carry strings such as "reception," "frontdesk," "reservations," and their equivalents in French, Polish, Czech, and Spanish. The attackers didn't stumble into hospitality — they deliberately sought out the employees most conditioned to open and act on guest-related communications without hesitation.
Lure themes reinforce this targeting logic. Subject lines reference bedbug infestations, failed health inspections, threatened platform suspensions, and unresolved guest complaints — the exact categories of correspondence that a front desk manager cannot afford to ignore. Messages have arrived in Japanese, Danish, and Dutch, with Japanese-language variants appearing most frequently. Notably, the emails omit recipient names and property identifiers, indicating high-volume list-based distribution rather than handcrafted spearphishing — scaling the attack without sacrificing plausibility.
Authentication Laundering: Defeating Email Security at Its Own Game
What separates this campaign technically is the delivery architecture. The threat actors abuse Calendly's email notification infrastructure and Google's URL redirection service to construct a multi-hop delivery chain that sails cleanly through SPF, DKIM, and DMARC validation checks. Emails arrive bearing the display name "Booking Manager (via Calendly)," a presentation indistinguishable from legitimate scheduling communications that hospitality staff receive routinely.
This technique — using trusted third-party infrastructure to launder malicious traffic through email authentication controls — represents a meaningful evolution in commodity phishing tradecraft. When a malicious link originates from Calendly and redirects through Google, the email that carries it is, technically speaking, authentic.
The redirect chain itself comprises four hops: from Calendly to share.google, then to www.google.com, then finally to a freshly registered domain fronted by Cloudflare's infrastructure. At that final destination, a Turnstile challenge functions simultaneously as an anti-analysis barrier and a geolocation filter — ensuring that security researchers and out-of-region traffic never reach the payload stage.
TonRAT Delivery and the Seven-Phase Obfuscation Evolution
Victims who pass through the redirect chain download a compressed archive containing a Windows shortcut file disguised as a PNG image — either IMG-<numbers>.png.lnk or PHOTO-<numbers>.png.lnk depending on campaign wave. Consistent file sizing across samples strongly suggests a shared builder tool.
Opening the shortcut executes PowerShell, which decodes a download URL using BigInt arithmetic before retrieving the next stage. Over the course of the campaign, analysts documented seven distinct PowerShell obfuscation phases — yet the underlying logic never changed. The operators aren't experimenting with new techniques; they're systematically re-skinning the same functional loader each time static detections catch up. It's an iterative durability strategy, not exploration.
The final payload is TonRAT, a JavaScript-based remote access trojan executed through a legitimate Node.js runtime downloaded directly from nodejs.org into the user's AppData directory. No system-wide installation is required — a deliberate choice that avoids triggering administrative privilege alerts. A second campaign wave introduced an intermediate .NET compilation step using csc.exe and cvtres.exe, generating small randomized DLLs before the Node.js execution path, likely as a preparatory evasion measure.
Persistence by Design: The Self-Refreshing Loop
The persistence architecture is among the more technically sophisticated elements observed in this campaign. The operators deploy a dual-path survival mechanism: a durable registry Run key under HKCU to maintain Node.js execution across logins, paired with a RunOnce entry that continuously refreshes the ProgramData payload after each execution cycle. The RunOnce entry doesn't fire once and retire — it rewrites itself, creating a self-sustaining loop.
This design proved its value in documented incidents. When endpoint protection blocked the primary executable payload on a confirmed compromised device, the Node.js Run key remained intact. Two days later, the implant reactivated autonomously, reconnected to new command-and-control domains, and resumed delivering additional payloads. Remediating one component while leaving the other untouched returned the attacker to full operational capability.
Post-compromise behavior includes C2 beaconing to fixed IP addresses over non-standard ports — including 56001, 56002, 56003, 8443, 8445, 8453, and 5555 — as well as headless browser automation observed on a subset of affected hosts, suggesting possible credential harvesting or session abuse activities beyond simple remote access.
What You Should Do
AppData\Local\Nodejs\ activity for review.The hospitality sector has long been viewed as a soft target by financially motivated threat actors — rich with payment card data, loyalty credentials, and internationally distributed infrastructure that complicates response. This campaign demonstrates that even the operational culture of the industry — the reflexive responsiveness to guest needs — can be reverse-engineered into an attack vector. Technical controls matter, but so does recognizing the human element being exploited.
