Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

Reported 26 Jun 2026 by otx · Severity: medium

Since April 2026, a sophisticated multi-stage intrusion campaign has targeted hospitality and hotel organizations across Europe and Asia. The operation uses photo-themed ZIP archives containing malicious shortcut files disguised as images. When executed, these shortcuts initiate