Hotels Targeted by Photo ZIP Phishing Campaign

An active phishing campaign has been targeting hotels in Europe and Asia since April 2026, using photo-themed ZIP files to deliver a Node.js implant. Attackers abuse Calendly and Google redirects to bypass email authentication checks. The malware disables Microsoft Defender, performs command-and-control beaconing, and gathers system information.