Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access (opens in new tab)

Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia. The campaign uses photo-themed ZIP archives and fake image shortcut files to deliver a persistent Node.js implant and evade detection. The post appeared first on .