Authentication Laundering via Calendly Drives Persistent TonRAT Phishing Campaign Against Hospitality Staff in Europe and Asia

Attackers targeting hotel and hospitality organizations across Europe and Asia have spent three months systematically refining a Node.js-based implant chain that abuses trusted scheduling infrastructure to bypass email authentication controls, according to threat intelligence published by Microsoft on June 25, 2026.

A Phishing Campaign Built on Authentication Laundering

The campaign uses what Microsoft Threat Intelligence calls “authentication laundering” to route malicious lures through Calendly, a widely used scheduling platform, before directing targets to attacker-controlled domains. Because the initial email originates from Calendly’s own sending infrastructure, it passes SPF, DKIM, and DMARC checks that would ordinarily flag third-party phishing. The sender appears as “Booking Manager (via Calendly),” a framing consistent with the communications hotel staff receive daily.

Microsoft has not attributed the campaign to a known threat actor.

The Infection Chain: From Fake Photo Archive to Node.js Implant

Initial Access

The phishing lure presents itself as a guest complaint, a room condition inquiry, or a bedbug report, with messages crafted in Japanese, Danish, and Dutch to match the geographies of targeted hotel organizations. Targets are directed to download a photo-themed ZIP archive. Inside, fake image shortcut files named in the pattern IMG-*.png.lnk or PHOTO-*.png.lnk trigger an obfuscated PowerShell chain when opened.

Execution and Evasion

The PowerShell stage has evolved through seven distinct obfuscation phases since April 2026, progressing from XOR-based BigInt decoding through modulo and arithmetic masking to syntax diversification with randomized variable names. In a second wave launched in late May 2026, the chain added a .NET DLL compilation step using csc.exe before delivering the final Node.js-based implant. The malware modifies Microsoft Defender exclusions for its working directory using Add-MpPreference, reducing the likelihood of in-situ detection.

TonRAT: The Node.js Payload

The ultimate payload is TonRAT, a Node.js-based remote access tool that attackers install using a legitimately downloaded copy of Node.js v24.13.0 stored in AppData. TonRAT establishes dual persistence through both HKCU Run and HKCU RunOnce registry entries, with a loop that refreshes persistence after each payload execution. Command-and-control beaconing occurs on non-standard ports including 56001 through 56003. Post-compromise activity observed by Microsoft includes browser automation using headless flags and forced system shutdowns.

Seven Phases in Three Months: What the Obfuscation Evolution Tells Defenders

The rapid iteration of PowerShell obfuscation is among the most operationally significant findings in Microsoft’s report. Seven distinct evasion phases across 60 days indicates an active operator willing to retool whenever detection catches up. Security operations teams that rely exclusively on static PowerShell signatures without behavioral monitoring will find each new phase effectively resets their detection coverage.

The addition of csc.exe in the second wave to compile a .NET DLL mid-chain places an extra compiled-in-memory stage between the scripting layer and the final implant, reducing file-backed artifacts available for endpoint detection and response platforms to scan. This technique has appeared in other advanced intrusion sets and signals an operator with practical knowledge of endpoint detection blind spots.

Hospitality as a Persistent Target Surface

Hotels represent an attractive target for interconnected reasons. Reception and front-desk staff handle high volumes of unsolicited photo attachments as part of routine operations, including legitimate guest inquiries, insurance claims, and maintenance documentation. This conditions staff to open exactly the type of attachment this campaign delivers. The same accounts typically have access to guest management platforms, reservation systems, and corporate network segments that could serve as lateral movement paths for broader intrusions.

The authentication laundering technique is the campaign’s structural innovation. SPF, DKIM, and DMARC verify that a message genuinely originates from the domain it claims; routing messages through a legitimate SaaS platform means those controls authenticate correctly while providing no protection against the lure itself. For a related example of implants targeting specific operational staff roles with platform-aware lures, see CyberTech’s coverage of the DPRK-linked macOS.Gaslight backdoor, which similarly exploited role-specific trust to establish persistent access.

What This Means for the Security Leader

CISOs relying on email authentication pass rates as a primary security metric will find that metric provides no signal against authentication laundering campaigns. The relevant control layer is not the email perimeter but the endpoint and user behavior layer: what occurs when an employee opens a file that cleared every email security filter.

The seven-phase obfuscation timeline creates a detection currency problem for signature-reliant programs. Detection logic written for Phase 1 of this campaign will not match Phase 7. Organizations that measure detection coverage by rule count rather than behavioral coverage are directly exposed to this class of iterative evasion. The hospitality sector, which often operates with constrained security resources relative to the volume of social-engineering exposure its front-line staff faces daily, should treat this campaign as a prompt to audit both endpoint behavioral controls and staff awareness programs around archive file handling from external sources.

Recommended Defender Actions

According to Microsoft Threat Intelligence, defenders should take the following steps:

• Alert on photo-themed ZIP archives delivered via Calendly or similar scheduling services, and investigate LNK files contained within them.
• Monitor for Node.js execution from AppData Local Nodejs directories and PowerShell invocations containing BigInt arithmetic patterns.
• Hunt for Add-MpPreference exclusion modifications made outside standard patch management workflows.
• Alert on csc.exe or .NET compilation initiated from PowerShell scripts.
• Investigate C2 beaconing on ports 56001 through 56003 and on IPs 178.16.54.27, 95.217.97.121, 193.202.84.32, and 178.16.55.179.
• During remediation, remove both Run and RunOnce registry persistence entries. Removing only one allows the refresh loop to immediately re-establish access.
• Block photo-*.cfd domain patterns at the DNS or web proxy layer.

Microsoft Defender XDR detects the campaign under the designations Trojan:Win32/Wacatac, TrojanDropper:PowerShell/TonRAT, Trojan:JS/TonRAT, and Trojan:Win32/PureRat.

Source: Microsoft Threat Intelligence