The phishing campaign that targets hotels and uses Calendly, Turnstile and TonRAT to infect receptions

Since April 2026 A phishing campaign is detected for hotels and hotel organizations in Europe and Asia that takes advantage of a photographic decoy to install an implant in reception machines, according to recent reports. The e-mails come with the visible sender "Booking Manager (via Calendly)" and contain complaints from guests, inspections or reputational threats, an approach aimed at rapid opening by front desk staff.

The most relevant is not just the hook but the technical chain: attackers use Calendly's infrastructure and Google's redirections to pass SPF / DKIM / DMARC checks - a technique that analysts call authentication launching- and refer the user to a newly registered domain that is behind a Cloudflare Turnstile challenge. This challenge acts as anti-analysis control and as a filter to prevent easy site study by defenders and sandboxes.

The file that is downloaded is a ZIP with shortcuts (.lnk) that pass through images; open them runs PowerShell. A script using BigInt operations reveals a secret URL, drops .ps1 to% TEMP% and unfolds a legitimate version of Node.js (v24.13.0) in the user space to run a JavaScript implant known as TonRAT. The malware resolves your command and control domains using the TON chain API and sets an encrypted WebSocket channel, which complicates the lock by using static domain lists.

The observed commitment signals include dual persistence (a RunOnce entry in ProgramData and a Run key for Node.js), files under AppData\\ Local\\ Nodejs and outgoing traffic to non-standard ports such as 8443, 8445, 8453, 5555 and ranges 56001-56003. In some teams, automation with headless-mode browsers, consultations with geolocation services (ip-api.com) and forced-off commands were also detected. Microsoft, SOC Prime and ITOCHU have documented the LNK → PowerShell → Node.js chain; the final intention of the attackers is not yet confirmed, but access is persistent and low cost to the operator.

What makes this campaign particularly dangerous: the combination of legitimate authentication for delivery, an anti-analysis challenge in front-end and the use of a legitimate user-installed runtime makes the detection based on signatures and black lists insufficient. In addition, the resolution of C2 through the Blockchain TON allows to rotate domains and makes traditional traceability difficult.

For security teams and hotel managers, the priority should be specific detection and containment: to search for processes not running from user routes, to check RunOnce entries in ProgramData and Run keys related to Node.js, and to track downloads from Calendly → share.google → chains to .cfd. domains It is also appropriate to monitor outgoing connections to the above-mentioned ports and the presence of processes that launch browsers with --headless --no-sandbox. The incomplete elimination leaves a way back if only half of the persistence is removed.

Operational containment: isolate suspicious endpoints, collect evidence (volatile and on disk), decouple reception machines from critical systems such as PMS or pay walkways, and run EDR searches by PowerShell patterns with unusual decoding or by non-standard Node.js installations in user profiles. After containment, credentials must be rotated, access to reserve accounts reviewed, and local reporting procedures must be reviewed if there is evidence of exfiltration.

In prevention, in addition to strengthening staff training on false booking and warning lures, it is essential to improve mail engineering: apply rules that inspect the content and reputation of links, enable rewriting of links and download sandboxing, and review mail logs in search of Calendly patterns and Google readdresses to new domains. Do not only trust a mail to pass SPF / DKIM / DMARC - these checks validate the sending route, not the message's intention.

The community must also adapt to techniques that use public infrastructure and legitimate services as a delivery vector; effective defence requires behavior-based detection and rapid response. To understand the technologies cited in the attacks, you can see the documentation of Cloudflare turntiles in Cloudflare Turnstile and official downloads of Node.js at Node.js. For more context on mail authentication and why it is not evidence of confidence, see DMARC.org.

Conclusion:: Although massive data theft or associated ransomware pattern has not yet been verified, the combination of legitimate delivery, multiple persistence and dynamic C2 makes this campaign a significant threat to the hotel. Effective protection requires behavioural-focused detection, complete forensic reviews of reception equipment and operational policies that reduce the health and reputational risk of opening unexpected attachments.