Hotel Phishing Attack Uses Calendly to Bypass Email Authentication Filters

A phishing campaign that has been targeting hotels across Europe and Asia since April 2026 is exploiting a fundamental flaw in how enterprise email security works — routing malicious messages through Calendly's legitimate notification infrastructure so that they pass every authentication check a corporate email filter runs, and then deploying a stealthy Node.js backdoor on the front-desk computers that receive them.

Microsoft Threat Intelligence disclosed the campaign on June 25, 2026, formally naming the delivery technique "authentication laundering" and warning that it represents a new documented evasion class with implications well beyond the hospitality sector. The core problem the campaign exploits is structural: SPF, DKIM, and DMARC — the three email authentication standards that enterprise security filters use as primary trust signals — were designed to confirm that a sender is authorized to send on behalf of a domain. They were not designed to assess whether the content of an authorized message is malicious. When attackers gain access to a legitimate platform's sending infrastructure, all three checks pass. The filter sees a clean result. The phishing email lands in the inbox.

The threat actors behind this campaign have made that gap operational at scale, and the same logic applies to any SaaS platform that sends email notifications on behalf of its users — from scheduling tools to e-signature services to project management platforms. Organizations that have treated a passing SPF, DKIM, and DMARC result as a meaningful safety signal are relying on a control that this class of attack has rendered unreliable.

The campaign begins with phishing emails that carry the display name "Booking Manager (via Calendly)." The messages are not spoofed — they are sent from a real Calendly account registered by the threat actors, specifically through the subdomain em1618.calendly.com, which uses Calendly's SendGrid-based sending infrastructure. Because the email is genuinely sent by Calendly's authorized servers, SPF passes. Because Calendly's SendGrid infrastructure applies a valid cryptographic signature, DKIM passes. Because the calendly.com domain aligns correctly, DMARC passes. The composite authentication result is clean. At the filtering layer, the message is indistinguishable from a legitimate Calendly notification.

The lures are crafted for hotel operations staff. Messages arrive in Japanese, Danish, and Dutch — the most common being Japanese — and reference guest complaints, bedbug infestation reports, verification call notices, room condition inquiries, and stay review requests. Every subject names an anonymous "guest" or "accommodation" without a recipient name, property name, or personalized detail, a pattern consistent with high-volume, list-driven sending rather than tailored spear phishing. The pressure is reputational: complaints, final warnings, threatened health authority inspections, possible suspension of operations.

Embedded in each email is a Calendly redirect URL that initiates a four-hop chain designed to fragment URL reputation analysis and obscure the final destination. The chain routes the target from a Calendly link through Google's .google redirect service to a Cloudflare-hosted domain registered in the .cfd top-level domain, where a Cloudflare Turnstile "verify you are human" challenge gates access and blocks automated analysis tools. Passing the challenge causes the page to serve a browser-downloaded archive named photo-[random numbers].zip.

The archive contains a fake image shortcut file — a Windows .lnk file with an extension disguised as a .png image. In the campaign's first wave, these files were named IMG-[random numbers].png.lnk; in a second wave documented by Microsoft, the naming shifted to PHOTO-[random numbers].png.lnk. The file sizes were consistent across observed samples, falling between 1,989 and 2,079 bytes, which Microsoft assessed as evidence of a shared builder tool. Victimized devices carried names including "reception," "frontdesk," "reservations," "accueil," and "recepce," confirming the campaign's targeting of front-office staff specifically.

When a hotel employee opens the file expecting an image, PowerShell executes. The script runs a BigInt-based arithmetic decoder to deobfuscate a download URL, pulls a second PowerShell script to the %TEMP% folder, and downloads the campaign's Node.js runtime — specifically node-v24.13.0-win-x64 — from the legitimate nodejs.org website. In Wave 2, an additional intermediate stage was observed: the downloaded PowerShell script triggers dynamic .NET DLL compilation through csc.exe, the C# compiler, and cvtres.exe, the resource converter, producing a randomly named 3,072-byte DLL before the Node.js stage executes.

The Node.js runtime — a legitimate, signed software component — functions as the execution vehicle for the malicious JavaScript payload, which runs entirely in memory rather than writing a detectable executable file to disk. The C2 domain is passed as a command-line argument to node.exe, with random-character JavaScript filenames observed across multiple compromised environments. The implant then establishes dual persistence by writing entries to two separate Windows registry run keys, ensuring it survives reboots. It also modifies Microsoft Defender's exclusion list to hide itself and any randomly named executables from real-time scans.

Post-compromise activity observed by Microsoft includes beaconing to command-and-control servers over non-standard network ports, the on-device compilation of portable executable (PE) payloads, and the forced shutdown of compromised machines. Microsoft has not attributed the campaign to a known threat actor and characterizes the end goal as unclear — though the investment in obfuscation and persistence across two distinct waves suggests preparation for additional follow-on activity beyond the initial foothold.

Cisco Talos researchers independently documented the same attack category in April 2026, naming it "Platform-as-a-Proxy." Their analysis found that attackers were exploiting the notification systems of GitHub and Jira in the same way — using legitimate platform infrastructure to dispatch phishing content that passes SPF, DKIM, and DMARC while carrying malicious payloads or redirect links. On the peak day of one GitHub-abusing campaign, Cisco Talos found that approximately 2.89% of all emails originating from GitHub's infrastructure were associated with this abuse pattern.

The structural implication is significant: any SaaS platform that sends automated email notifications on behalf of its users can serve the same function. Meeting scheduling tools, e-signature platforms, project management systems, customer relationship management tools, invoice platforms, and HR workflows all send email through infrastructure that passes authentication checks — because the infrastructure is legitimate even when the content is not. Cisco Talos described the defensive gap directly: because the emails are dispatched from a platform's own infrastructure, they satisfy all standard authentication requirements, effectively neutralizing the primary gatekeepers of modern email security.

For organizations that have resolved the "living off the land" problem at the operating system level — deploying endpoint detection tools that catch attackers abusing PowerShell, WMI, and other native Windows binaries — this campaign represents the same problem at a different layer. EDR tools monitor what happens on the device after an attacker gains a foothold. They do not inspect the email authentication layer that determines whether a phishing email reaches the inbox in the first place. The Calendly campaign and the GitHub/Jira campaigns documented by Cisco Talos are exploiting a gap that most organizations have not yet instrumented.

The hospitality sector has been a sustained target for cybercriminals for reasons that make the current campaign's post-compromise ambiguity particularly concerning. Hotel front-desk systems connect directly to property management systems, payment processing infrastructure, guest data repositories, and reservation databases. The Otelier hotel management platform breach disclosed in early 2026 exposed data tied to Marriott, Hilton, and Hyatt guest records, including names, email addresses, phone numbers, travel details, and in some cases partial payment card data. In May 2026, BWH Hotels — the group behind Best Western and more than 4,000 properties worldwide — disclosed that attackers had access to its guest reservation system from October 2025 through April 2026.

The hospitality sector in Europe faces additional regulatory exposure. Under the EU's General Data Protection Regulation, a hotel breach that exposes guest personal data carries potential fines of up to 4% of global annual revenue. The same guest-data categories that make hotel front-desk systems attractive targets — names, details, travel dates, payment records, loyalty membership information — are precisely the data categories whose unauthorized access triggers mandatory breach notification obligations under GDPR.

Microsoft has not disclosed specific indicators of compromise in the public-facing version of its report. The company published detection guidance for Microsoft Defender users and recommended that security teams monitor for Node.js processes spawning from unexpected parent processes, PowerShell activity involving BigInt decoding patterns, registry persistence entries created in Windows run keys by unfamiliar processes, and outbound network traffic over non-standard ports.

Most organizational phishing training focuses on teaching employees to inspect sender domains, look for mismatched display names, and be suspicious of urgent language. This campaign defeats all three of those signals. The sender domain is genuinely Calendly's. The display name — "Booking Manager (via Calendly)" — accurately reflects the sending platform. And the urgency, while manufactured, is entirely plausible for a hospitality worker who routinely receives guest complaints.

What the campaign cannot disguise is the action it asks the target to take: downloading a compressed archive and opening a file that appears to be a photograph. Organizations should add this specific behavior to staff training: a Calendly notification that results in a downloaded ZIP file is not a normal Calendly workflow, regardless of how legitimate the email's authentication credentials appear. The compressed archive, the fake image shortcut, and any prompt to open an attachment from a scheduling notification are the specific behavioral indicators that this campaign depends on.

How does the Calendly phishing attack on hotels work?

Attackers register a real Calendly account and use its email notification system to send phishing messages to hotel staff. Because the email is genuinely sent through Calendly's authorized infrastructure, it passes the three standard email authentication checks — SPF, DKIM, and DMARC — that most enterprise spam filters rely on as primary trust signals. The message lands in the inbox looking legitimate, carrying a link that ultimately delivers a malicious archive containing a fake image file that installs malware when opened.

What is authentication laundering and does it affect email systems beyond hotels?

Authentication laundering is Microsoft's term for the technique of routing phishing messages through a legitimate platform's email sending infrastructure to inherit that platform's trusted authentication credentials. The same technique works against any organization that treats a passing SPF, DKIM, and DMARC result as a meaningful safety signal. Cisco Talos documented identical attacks abusing GitHub and Jira in April 2026, naming the broader category "Platform-as-a-Proxy." Any SaaS platform that sends email notifications on behalf of its users is a potential relay for this class of attack.

What can hotel security teams do right now to reduce exposure?

Microsoft advises monitoring for Node.js processes running from unusual parent processes, PowerShell activity involving BigInt decoding, registry persistence entries created by unfamiliar processes, and outbound traffic on non-standard ports. For staff, the behavioral indicator to train for is any scheduling notification that results in a downloaded archive file — a ZIP containing a file that appears to be a photo is not a normal outcome of any Calendly interaction. Email filters should be configured to apply behavioral scrutiny to messages arriving via third-party notification platforms, not just authentication-passing messages generally.

Why do attackers continue targeting hotels specifically?

Hotels handle unusually high volumes of external communications from strangers, which makes staff more likely to open unsolicited attachments. Front-desk systems connect to property management infrastructure, payment systems, and guest databases containing names, information, travel dates, and payment card records. The BWH Hotels breach disclosed in May 2026, in which attackers had access to guest reservation data across more than 4,000 properties for six months, illustrates the value and vulnerability of that data. The average cost of a hospitality sector data breach was $3.86 million in 2024, and the sector has been breached repeatedly at major chains including MGM Resorts, Marriott, and Caesars Entertainment.