Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain

Cybersecuritynews •Tushar Subhra Dutta • October 8, 2026

Hackers are targeting hotels with fake guest complaints and negative reviews that lead staff to malware disguised as photographic evidence. The campaign delivers EtherRAT or TONResolver, two malware families that use public blockchains to find their command and control servers instead of relying on a fixed address inside the malware. The emails reach front desk, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hackers Exploit Fake Hotel Complaints to Distribute Blockchain Malware Hackers are targeting hotels with fake guest complaints and negative reviews to spread EtherRAT and TONResolver malware. The attacks involve phishing emails that trick hotel staff into downloading malicious LNK files disguised as image files. These malware families utilize public blockchains to locate their command-and-control servers, making detection difficult. The campaigns appear to be a continuation of previous phishing operations, particularly those spoofing Booking.com. Attackers are believed to use generative AI to create varied complaint narratives, complicating detection efforts. The emails reach front-desk and guest-relations personnel, increasing the pressure to respond. Cofense Intelligence has assessed the connection between these campaigns with moderate confidence. The malware execution relies on a legitimate Node.js runtime to run the malicious payloads. 2 sources 51

Extracted Entities

Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (1)