Booking-Themed Phishing Campaign Deploys TonRAT via Node.js Implant Targeting Hotel Front Desk Systems

Microsoft has documented an active phishing campaign targeting hotel and hospitality organisations across Europe and Asia since April 2026, deploying a Node.js-based remote access trojan tracked as TonRAT through booking-complaint lures designed to exploit the reputational pressures unique to front-desk operations. The campaign has not been attributed to a known threat actor and Microsoft has not confirmed what the operators ultimately want from the access they are establishing.

The GCC's hospitality sector carries direct exposure to this campaign type. The UAE and Saudi Arabia together represent one of the world's largest concentrations of international hotel brands, with Dubai alone hosting more than 140,000 hotel rooms across properties operated by every major global chain. Front-desk systems at these properties, which process reservations, guest identity documents, and payment card data, represent exactly the kind of high-value, operationally pressured target this campaign methodology is designed to exploit.

How the Lure Works

The phishing emails arrive with the display name "Booking Manager (via Calendly)" and reference guest complaints, bedbug infestations, room inquiries, health inspections, and stay reviews. None of these lures names a specific recipient or property, indicating high-volume, list-driven sending rather than targeted spear phishing. The pressure applied is reputational: complaints, final warnings, and threatened inspections create urgency that encourages rapid action without careful verification.

The delivery mechanism is notable. The operators route emails through Calendly's legitimate email notification infrastructure and Google's URL redirect service, a technique Microsoft describes as authentication laundering. Because the emails genuinely originate from Calendly's authorised infrastructure, they pass SPF, DKIM, and DMARC checks correctly. These checks confirm the sender is authorised. They say nothing about the message's intent.

A multi-hop link chain then walks the victim from the Calendly link through a Google redirect to a freshly registered, Cloudflare-fronted .cfd domain. That domain sits behind a Turnstile challenge that doubles as an anti-analysis barrier.

The TonRAT Implant

Clicking through triggers the download of a photo-themed ZIP file. Inside is a shortcut file masquerading as an image with a .png.lnk extension. Opening it fires PowerShell, which uses BigInt arithmetic to decode a hidden download URL, pulls a secondary script to %TEMP%, and drops a legitimate Node.js v24.13.0 runtime downloaded directly from nodejs.org into user space. No system-wide Node installation is required, making the deployment difficult to detect through software inventory monitoring alone.

The JavaScript implant resolves its command-and-control domains through the TON blockchain API before opening an encrypted WebSocket channel. Fetching C2 domains dynamically through the blockchain makes static blocklists structurally ineffective against this campaign. After compromise, the implant beacons to fixed IP addresses over non-standard ports including 8443, 8445, 8453, 5555, and 56001 to 56003. Some compromised hosts also showed headless browser automation activity and a geolocation check, alongside a forced system shutdown command.

Remediation Is Non-Trivial

Microsoft notes that full remediation must address both persistence paths simultaneously. The RunOnce registry entry pointing into ProgramData and the Node.js Run key must both be removed, along with the Node.js runtime and JavaScript files under AppData\Local\Nodejs. Removing only one path leaves the other intact and the implant active. Reception, reservations, and front office systems are the priority investigation targets, as these are the most likely points of initial delivery given the booking-complaint lure content.

This campaign connects to a broader pattern of booking-themed attacks against hospitality operators. ClickFix campaigns targeting hotel staff have previously dropped PureRAT specifically to steal Booking.com login credentials. The same reputational pressure logic drives both campaigns: front desk staff are trained to respond quickly to complaints, and that operational urgency is the social engineering vector.

For GCC hospitality security teams, the practical implication is a review of email security controls specifically for Calendly and Google-redirect chain delivery, endpoint monitoring for unexpected Node.js runtime installations in user-space directories, and staff awareness training that explicitly addresses booking-complaint lure patterns alongside standard phishing indicators.