Separate but similar campaigns described by Microsoft and Trend Micro use malicious zip files to spread malware via social engineering and obsfucation, including blockchain abuse.
June 30, 2026, By Elizabeth Montalbano
Source: Henk Vrieselaar via Alamy Stock Photo
Attackers have been targeting hotels and other hospitality organizations with a phishing campaign that uses malicious zip files purporting to include guest photos, with the aim of installing malware to achieve long-term access to compromised systems.
Both researchers at Microsoft and Trend Micro have observed the malicious activity, though they did not confirm if it was connected, according to separate reports published recently. Neither company immediately responded to a request for comment by Dark Reading about a potential link between the activities they described.
Attackers in both campaigns use similar social engineering tactics to target the hospitality sector by impersonating guests who have complaints or requests, and then ultimately installing malware to gain a foothold on systems. They are both also relying on operational workflows familiar in a hospitality environment, where front-desk staff and reservation teams field inquiries from guests, the researchers said. And both sets of activity exploit trusted services to lend legitimacy to phishing emails, and ultimately deliver malware through zip archives containing Windows shortcut files disguised as images. This technique in particular has become increasingly popular among phishing attackers as Microsoft has restricted macro-based malware delivery.