Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

Author(s): Microsoft Defender Experts, Microsoft Defender Security Research Team, Parth Jomadkar
Organization: Microsoft Security

Open article directly Open article on Archive.org

2026-09-22 ⋅ Microsoft ⋅ Microsoft Defender Experts, Microsoft Security Research, Microsoft Threat Intelligence
Unmasking EvilTokens: Getting to the root of device code phishing
Storm-2992

2026-07-16 ⋅ Microsoft Security ⋅ Balaji Venkatesh S, Microsoft Security Research
ACR Stealer: Two observed intrusion chains amid increased threat activity
ACR Stealer

2026-05-18 ⋅ Microsoft ⋅ Microsoft Defender Security Research Team
How Storm-2949 turned a compromised identity into a cloud-wide breach
Storm-2949

Propose Change Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access