Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

By Microsoft Defender Security Research Team, Microsoft Defender Experts, Parth Jomadkar

Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026. We’ve observed this activity through aggregated threat intelligence and security signals across multiple organizations in Europe and Asia. Microsoft has not attributed this campaign to a known threat actor.

The campaign uses photo…