Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant

Microsoft is warning of an ongoing phishing campaign targeting hotels and hospitality organizations in Europe and Asia. The campaign, which started in April 2026, uses ZIP files disguised as photos to deliver a Node.js implant, allowing attackers to access front-desk machines. The goal of the attackers is currently unknown, and Microsoft has not attributed the activity to a specific threat actor. The phishing tactic appears to be designed to exploit common practices within the hotel industry.