Booking-Themed Spam Delivers Node.js Backdoor

How the Attack Worked

This campaign targets hospitality workers with booking-themed spam emails designed to look like ordinary reservation requests. The message directs recipients to a link hosted on Google Share, a choice that lends the email a veneer of legitimacy while also helping it slip past email security filters. Clicking through leads to a malicious ZIP file. Inside the archive is not a normal document but a Windows shortcut (.LNK) file. Opening that shortcut silently executes a hidden PowerShell command, which in turn downloads a legitimate node.exe binary and uses it to deploy a Node.js based backdoor on the victim's machine.

Why It Succeeded

The lure plays directly into the daily workflow of front desk, reservations, and hospitality operations staff, who routinely receive and act on booking and reservation messages from guests or third-party services. Because reviewing reservation details is a normal part of the job, an unexpected booking email does not immediately stand out as suspicious. Hosting the malicious link on a well-known file-sharing platform like Google Share adds a layer of perceived trust and helps the email bypass automated filtering that might otherwise flag less reputable domains.

What to Watch For

• An unexpected booking or reservation email that pressures the recipient to download and open a file
• A link that routes through a third-party file-sharing service rather than an attachment or direct company portal
• A downloaded ZIP file that contains a shortcut (.LNK) file instead of a standard document format like PDF or DOCX
• Any prompt to "view details" that results in unusual system activity after opening a file

Building Resistance

Hospitality staff in front desk, reservations, and administrative roles should be trained to treat unsolicited booking or reservation emails with caution, particularly when they push urgency around downloading files. File-sharing links, even from recognizable platforms, should not be treated as inherently safe since attackers can abuse trusted hosting to bypass filters. Staff should be taught to recognize that legitimate reservation documents are rarely delivered as shortcut files inside a ZIP archive, and any such file should be reported to IT or security rather than opened. Reinforcing these habits through realistic, role-specific awareness training can help reduce the chance that a booking-themed lure leads to a successful compromise across hospitality and travel accommodation environments.

How does the booking-themed spam attack work?

Attackers send emails with booking-themed lures to hospitality workers, pointing to a link hosted on Google Share. Clicking it leads to a malicious ZIP file containing a Windows shortcut that runs a hidden PowerShell command, which downloads a legitimate node.exe and deploys a Node.js based backdoor.

Why is the link hosted on Google Share instead of a random site?

The threat actor abuses Google Share hosting to make the link look legitimate and to help the message evade email security filtering.

What is the red flag inside the malicious ZIP file?

Instead of a normal document like a PDF or DOCX, the ZIP contains a Windows shortcut (.LNK) file, which is used to trigger the hidden PowerShell command.

Who is being targeted by this campaign?

The campaign targets front desk, reservations, hotel management, and hospitality operations staff who regularly handle booking and reservation requests.